Topic
#Security
Loot, blog posts and adjacent themes connected to this topic. Follow the tag to keep it in your orbit.
23Shown loot
30Shown articles
8Linked neighbor tags
Topic paths
If you want to go deeper, the adjacent tags are the fastest way to compare and branch into related workflows.
Loot
More from this topic
ByteDance’s UI-TARS Desktop is one of the most interesting open-source computer-use agents right now: it sees your screen, clicks, types, and works across desktop and browser tasks. The important nuance is security: the app can feel local-first, but privacy depends on how you host the model and whether you disable optional telemetry and report upload flows. UI-TARS Desktop is not just another agent demo. It is a real open-source desktop automation app that can watch the screen, move the mouse, type, and complete GUI tasks through natural-language instructions. At the time of writing, the repo sits at 30.7k+ GitHub stars, which explains why it is suddenly everywhere. What it actually offers local computer operator for desktop tasks browser operator mode for web workflows natural-language control powered by a vision-language model screenshot understanding plus mouse and keyboard execution official quick-start docs, settings docs, and public showcase clips Apache-2.0 licensed repo with the UI-TARS research paper behind it Security reality check The viral pitch says “runs 100% locally,” but the practical answer is more nuanced. The official docs show the desktop app connecting to external or self-hosted OpenAI-compatible model endpoints such as Hugging Face or VolcEngine. So the GUI control can be local, but privacy depends on where your model inference happens. Here is the more useful security read: good: the app itself is open source and the main operator runs on your own machine good: the project has a public security policy and a formal vulnerability-report path good: official docs surface permission requirements clearly, especially screen recording and accessibility on macOS watch out: optional report upload docs explicitly note there is currently no authentication designed for the report storage server watch out: the UTIO event endpoint can receive app launch, instruction, and share-report events if you configure it watch out: if you point the app at hosted inference endpoints, your screenshots and task context may leave the machine depending on that backend watch out: the current docs also note single-monitor assumptions and remote-operator history, so this is not a zero-risk “install and forget” tool Best practices before you trust it with real work Where it looks genuinely useful repetitive desktop QA flows browser-side task automation without building a custom script for every site controlled internal demos of computer-use agents research and evaluation against GUI benchmarks experimentation with open-source alternatives to expensive proprietary computer-use stacks Official showcase and app screens UI-TARS Desktop app screen UI-TARS Desktop settings screen The official README also links showcase clips for: changing VS Code autosave settings with the local operator checking the latest GitHub issue with the agent remote operator demos for desktop and browser workflows Why this repo matters The underlying UI-TARS paper claims state-of-the-art benchmark performance across GUI-agent tasks, including stronger numbers than several well-known closed-model baselines in parts of OSWorld and AndroidWorld. That does not automatically mean better production reliability, but it does make the repo more than just hype. My bottom line UI-TARS Desktop is one of the best open-source computer-use projects to watch right now because it combines a real app, public docs, showcase examples, and a research-backed model story. Just do not repeat the lazy “100% local” claim without the important qualifier: it is only as private as the endpoint and integrations you configure.
- LinkLoot access
- Free
- Provider costs
- Unknown
Review open
Text: AI-generated
AI-generated · Automatically published by LinkLoot. Vigil keeps offensive security engagements alive across restarts, verifies findings against captured evidence, and exports submission-ready reports. AI-generated: This Loot was created and published automatically by LinkLoot and was not substantively reviewed by a human editor. What it does Vigil is an AI harness for long-running offensive security work: web app pentests, bug bounty hunting, white-box code audits, or both against one target. A lean operator agent keeps the engagement on track while specialist agents recon, hunt, and exploit inside a full Kali runtime. Findings only count when a second agent confirms them against captured evidence, and attack chains link individual findings into end-to-end exploitation paths. Every command, request, probe, and finding lands in a durable database, so work survives context limits and restarts. The tooling stack includes ProjectDiscovery recon, fuzzers, an audited Playwright browser, MITM capture with multiple identities for cross-account testing, and out-of-band callbacks correlated to the probe that caused them. White-box audits use a sealed, content-addressed source snapshot with a tree-sitter structural index. Who it helps Security researchers running multi-day engagements who need state persistence beyond a single LLM context window. Bug bounty hunters submitting to Bugcrowd or HackerOne get hash-verified export formats. Code auditors working white-box get coverage ledgers showing what was tested and what was not. Getting started Requires Python 3.11+. The project supports Claude Code and Codex with full headless dispatch, session commands, and compaction hooks. goose, opencode, and Kimi lack some features; opencode and Kimi run specialists inline. Target-facing commands run through vigil assess kali, which records each command's argv, agent, phase, technique, intent, probe kind, exit status, and output. Limits and costs Authorized use only. Vigil autonomously drives offensive tooling against live systems. Use it only with explicit authorization and a reviewed scope. It is provided without warranty under Apache License 2.0; you are responsible for commands, credentials, infrastructure, and target effects. Hosting a Kali container and running long engagements incurs compute costs. No pricing is documented. Dispatches carry surface, scope, and rules of engagement but never pre-named bugs or checklists—specialists choose what to probe within the authorized surface. Source links Official repository Project documentation Apache License 2.0
- LinkLoot access
- Free
- Provider costs
- Unknown
Review open
Text: AI-generated
AI-generated · Automatically published by LinkLoot. Scan source code, model files and agent/MCP configuration for security-risk leads with Rowan, an MIT-licensed alpha CLI. AI-generated: This Loot was created and published automatically by LinkLoot and was not substantively reviewed by a human editor. Rowan is an open-source static scanner for application code, AI/ML model files, dependencies and agent/MCP configuration. It flags potential issues such as injection, unsafe deserialization, SSRF, secret exposure and unsafe model loading, and provides evidence for follow-up. Setup: Python 3.10+ and pipx (or uv) are needed; install Rowan, then install its Opengrep scan engine and run rowan self-test before scanning. The getting-started guide covers platform-specific installation. Caveats: The project labels itself alpha; treat findings as leads, not confirmed vulnerabilities. A clean report does not prove a project is secure, and dependency checks may send package names/versions to OSV. No hands-on testing is claimed. Sources: official repository and setup guide.
- LinkLoot access
- Free
- Provider costs
- Unknown
Review open
Text: AI-generated
AI-generated · Automatically published by LinkLoot. A practical Cloudflare resource for letting users approve only the OAuth permissions an application actually needs. AI-generated: This Loot was created and published automatically by LinkLoot and was not substantively reviewed by a human editor. Cloudflare's Optional OAuth Scopes feature lets OAuth client developers separate required permissions from optional ones, giving users more control over what an application can access. What it is Developers can mark configured OAuth scopes as optional in the Cloudflare dashboard. Required scopes must be approved, while users can decline optional scopes during consent. Cloudflare also provides Read Only and Full Access templates plus scope search. Who it helps This is useful for developers building Cloudflare integrations, CLIs, deployment tools, MCP servers, and agent workflows. It supports least-privilege consent without forcing users to grant every permission an application might eventually use. How to evaluate it Review the scope configuration in a non-critical Cloudflare account. Test approvals with optional scopes both enabled and declined, then verify that the application handles the returned permission set instead of assuming every requested scope was granted. Limits and risks Optional scopes are selected by default on the consent screen, so users still need to actively review permissions. Required scopes remain mandatory. Existing authorizations and account-level OAuth restrictions may also affect the result. Access and pricing The feature is part of Cloudflare's OAuth tooling. No separate price is stated in the cited release materials. Sources Cloudflare Optional OAuth Scopes changelog Cloudflare OAuth authorization documentation Cloudflare announcement
- LinkLoot access
- Free
- Provider costs
- Unknown
Review open
qsa.sh gives VPS and server operators a quick outside-in security scan of the public IP they are connecting from, with a free tier and paid deeper scans. qsa.sh is a practical terminal-first security checker for people who run their own servers and want a quick view of what the public internet can see. Run curl https://qsa.sh from the server you control and the service scans the public IP behind that request. The free scan covers common ports and selected vulnerability checks, then streams results back to the terminal. That makes it useful for quick VPS hygiene checks after deploying a new machine, changing firewall rules, moving behind a tunnel, or auditing a small self-hosted service. The key constraint is also the safety feature: there is no arbitrary target box. qsa.sh scans the IP that connects to it, gives a short abort window before work begins, and says it refuses common shared-network cases such as mobile-carrier, CGNAT, VPN, Tor, and proxy origins on a best-effort basis. Use it only on infrastructure you are authorized to scan. Pricing/access visible on the source page: Free: common-port live scan with naabu, nmap plus vulners, and a curated nuclei set. Full: paid monthly deeper port coverage. Deep: paid one-time full nuclei-style report. Practical use cases: Verify that a fresh VPS exposes only the services you expect. Re-check a host after changing Docker, firewall, Cloudflared, or reverse-proxy rules. Keep a lightweight manual audit step before publishing a self-hosted app. Compare the free scan with your own local nmap/nuclei workflow before paying for deeper reports. Caveats: this is not a full penetration test, the wrapper service itself is not presented as open source, and any security scan can produce false positives or miss issues. Treat the output as a fast triage signal, not as proof that a host is safe.
- LinkLoot access
- Free
- Provider costs
- Unknown
Review open
Text: AI-generated
AI-generated · Automatically published by LinkLoot. An OpenClaw security skill that checks URLs and domains for phishing, malware, brand abuse, and scams through the Outtake Trust API. Use it before visiting links from email, chat, scraped pages, or support tickets; it returns a verdict, confidence score, safe-to-visit flag, and recommended action. Requires an OUTTAKEAPIKEY. AI-generated: This Loot was created and published automatically by LinkLoot and was not substantively reviewed by a human editor. Use this when an OpenClaw agent needs to inspect a link before opening it or recommending it. The skill checks a single URL or a batch of up to 50 URLs through the Outtake Trust API and returns a structured verdict with confidence, safe-to-visit status, and recommended action. Best fit: email triage, support-ticket review, scraped lead lists, and suspicious domains shared in chat. Requires an OUTTAKEAPIKEY.
- LinkLoot access
- Free
- Provider costs
- Unknown
Review open
OneCLI is an open-source credential gateway that lets agents call services through placeholder keys while the gateway injects real secrets at request time. OneCLI is worth evaluating if your agents need API access but you do not want raw keys sitting in prompts, project files, shell history, or agent memory. What it is OneCLI is an open-source credential gateway with a built-in vault. You store real API credentials once, give an agent a placeholder key, and route outbound HTTP calls through OneCLI. The gateway matches the target host and path, decrypts the right secret, and injects it into the request so the agent never sees the real credential. The repository describes a Rust gateway, a Next.js dashboard, AES-256-GCM encrypted storage, host/path matching, per-agent access tokens, and optional Bitwarden-style vault integration. Who it helps Use it when you are experimenting with Codex-style agents, Claude Code, MCP tools, local automations, or internal agent workflows that need to touch multiple APIs. The cleanest fit is a local or small-team setup where credential exposure is the main risk and you want one place to rotate keys, scope agent access, and inspect what each agent is doing. How to evaluate it Start in a throwaway local workspace. Read the README, inspect the Docker compose setup, review how secrets are encrypted, and test with a non-critical API token first. Confirm whether the gateway behavior fits your agent stack before connecting production accounts. Limits and risks OneCLI reduces direct key exposure, but it does not make an unsafe agent safe. A compromised or prompt-injected agent may still call allowed services through the gateway. You still need scoped API keys, logging, rate limits, approval gates for destructive actions, and a clear rotation plan. The HTTPS interception model also deserves careful review before team or production use. Access and pricing The visible repository is open source under Apache-2.0. The project also links to a website and docs; check the current hosted or team offering separately if you need managed deployment. Sources OneCLI GitHub repository OneCLI website
- LinkLoot access
- Free
- Provider costs
- Unknown
Review open
A self-hosted security research workbench that turns Codex or Claude Code agents into focused, de-duplicated vulnerability scans. open-kritt is a self-hosted security research platform for developers and bug-bounty teams that want AI agents to inspect code in smaller, repeatable workflows instead of asking one model to audit an entire repository at once. It lets you build prompt-based scan workflows, run them with Codex or Claude Code, validate findings with post-scripts, rank severity, and de-duplicate results before review. Why it is useful: It is aimed at practical code-security work: scoped scans, reusable workflows, findings, ranking, and proof-building rather than generic chat. It supports model access through Codex, OpenAI, Anthropic, or OpenRouter, so teams can choose the provider path that fits their setup. The project is open source under AGPL-3.0 and includes a local Docker Compose stack plus a repository-local ./kritt CLI. Use it carefully. The project documentation states that tool-enabled scan agents run as root inside disposable containers with writable repository copies and direct internet access. The backend is unauthenticated by default. That makes open-kritt best suited for a dedicated VM or isolated Docker host, with scoped credentials and network controls, especially when scanning untrusted or private repositories. A good first evaluation path is to read the threat model, clone the repository on an isolated machine, run ./kritt setup, configure one model-access option, and scan a small non-sensitive repository before connecting private code.
- LinkLoot access
- Free
- Provider costs
- Unknown
Review open
Agent Passport is an OpenClaw skill candidate for scoped mandates, action checks, spending caps, allowlists, and audit logs before agents take sensitive actions. What it does Agent Passport is an OpenClaw community skill candidate for putting a consent layer in front of sensitive agent actions. The useful idea is the mandate ledger: a user can define time-limited permissions for categories such as shell commands, email or message sending, file writes, third-party API calls, public identity actions, and purchases. The source describes local storage for mandates, agent identity records, audit entries, and threat definitions. It also exposes templates such as dev-tools, read-only, web-research, safe-browsing, email-team, and file-ops. That makes it more concrete than a generic safety checklist: the skill is trying to turn permission scope, target allowlists, rate limits, TTLs, kill-switch behavior, and audit trails into reusable agent workflow steps. Pricing/access note: the public source shows a free local mode. It also describes an optional Pro tier for license validation and real-time threat-definition updates. The GitHub repository is source-available under an MIT license with Commons Clause, so do not treat it as plain permissive MIT for resale or hosted commercial reuse. Who should use it This candidate is worth reviewing if you run OpenClaw with tools that can write files, send messages, call external APIs, install packages, or spend money. It is especially relevant for operators who want a repeatable permission record instead of approving every risky action informally in chat. Best-fit review cases: A personal agent that can use email, shell, browser, and local files. A team agent where actions need audit notes after execution. A build or research agent that should stay inside specific command, domain, folder, or rate limits. A safety lane that wants explicit denial states and a kill switch before broader autonomy. Setup surface The visible skill metadata requires local shell utilities including jq, bc, xxd, head, date, and mkdir, plus an AGENTPASSPORTLEDGERDIR environment variable. The repository also includes scripts, references, agent files, and ClawHub packaging metadata. Reviewers should inspect the full repository, not just SKILL.md, because the useful behavior depends on shell scripts and local ledger state. Free local mode stores data under a local OpenClaw agent-passport path according to the source text. The optional Pro path introduces network calls to api.agentpassportai.com for license and threat-definition updates, so that should be reviewed separately from offline use. Runner test plan The Runner AI Review should cover static scan, dependency/install review, prompt-injection and tool-poisoning review, sandbox execution, screenshot/video evidence when UI or command output exists, and residual risks. Minimum checks: Static scan: read SKILL.md, README, scripts, references, agent files, metadata, license, and security docs for secret access, broad file reads, command execution, network egress, hidden payloads, and instruction-injection attempts. Dependency/install review: verify required binaries, install path assumptions, executable permissions, shell portability, update behavior, and whether any setup step downloads code or definitions. Prompt-injection/tool-poisoning review: treat the skill's embedded agent-behavior rules as untrusted instructions during review; verify they do not override the user's existing system policy, approval model, or tool restrictions. Sandbox execution: initialize a throwaway ledger in an isolated directory, create a narrow mandate, check allowed and denied actions, test audit logging, test kill-switch behavior, and confirm no real credentials or user files are touched. Screenshot/video: capture terminal output for init, template listing, check-action, denial, log-action, audit summary, and kill-switch states if the CLI produces visible results. Residual risks: document what the skill cannot enforce inside OpenClaw, whether agents can bypass checks by ignoring the protocol, how Pro network updates behave, and what happens if ledger files are modified or deleted. Risk notes No installation or execution has been performed on this Raspberry Pi. This Loot is a review candidate, not a safety endorsement. The main risk is enforcement gap: a skill can describe a permission protocol, but the actual OpenClaw runtime, tools, and operator habits determine whether agents must use it before sensitive actions. Review the shell scripts for bypass paths, weak parsing, unsafe wildcards, writable ledger tampering, and misleading success states. The source also contains direct instructions aimed at agents. Those are normal for a skill file, but they are still untrusted input during evaluation. A reviewer should quote and assess them, not obey them. Source links Awesome OpenClaw Skills list: https://github.com/VoltAgent/awesome-openclaw-skills/blob/main/categories/web-and-frontend-development.md ClawHub page: https://clawhub.ai/markneville/agent-passport Clawskills listing: https://clawskills.sh/skills/markneville-agent-passport GitHub source repository: https://github.com/agentpassportai/agent-passport Direct SKILL.md source: https://raw.githubusercontent.com/agentpassportai/agent-passport/main/SKILL.md
- LinkLoot access
- Free
- Provider costs
- Unknown
Review open
Agentgate gives OpenClaw agents a controlled API gateway for personal services, with immediate reads and approval-queued writes. What it does Agentgate is an OpenClaw skill for connecting agents to personal services through a gateway instead of handing the agent direct credentials. Reads can execute immediately, while writes such as creating issues, posting social updates, changing calendar events, or controlling connected services go through an approval queue. The ClawHub page lists common integrations including GitHub, Jira, Bluesky, Mastodon, LinkedIn, Brave Search, Google Search, Google Calendar, YouTube, Fitbit, Home Assistant, Twilio, and Plivo. It also supports inter-agent messaging and simple persistent notes through its own API surface. Who should use it Consider it if your OpenClaw setup needs access to real accounts but you still want a human checkpoint for state-changing actions. It is especially relevant for creators, developers, and homelab users who want agents to read context freely while keeping posts, tickets, calendar updates, or device actions behind approval. Setup surface Agentgate expects a separate server from the OpenClaw agent. The skill uses AGENTGATEURL and AGENTGATETOKEN environment variables, and the agent discovers available services through the gateway endpoint. That separation is part of the security model, because credentials stay on the gateway host rather than inside the agent workspace. Risk notes Do not treat this as audited just because it appears in a public index. Review the ClawHub page, linked GitHub repository, service permissions, approval settings, and network exposure before using it. Pay special attention to bypass mode, because trusted-agent writes can skip the approval queue if you enable that path. Sources Awesome OpenClaw Skills: https://github.com/VoltAgent/awesome-openclaw-skills ClawHub listing: https://clawhub.ai/monteslu/skills/agentgate Skill mirror: https://clawskills.sh/skills/monteslu-agentgate Project source: https://github.com/monteslu/agentgate
- LinkLoot access
- Free
- Provider costs
- Unknown
Review open
A community OpenClaw skill candidate for static review, capability mapping, risk scoring, and lockfile checks before trusting agent skills or MCP tools. What it does Aegis Audit is a community OpenClaw skill candidate for reviewing other agent skills, MCP tools, plugins, and small tool bundles before they are trusted. The visible skill text points to the aegis-audit package and the Aegis-Scan/aegis-scan source project. Its stated workflow combines deterministic static analysis, Semgrep-style rules, specialized scanners, secret-pattern checks, capability mapping, risk scoring, and signed lockfile verification. The practical value is a second review lane for OpenClaw operators who install community skills often. Instead of relying only on a README summary, it tries to map what a candidate can actually touch: files, URLs, commands, ports, package behavior, suspicious strings, hidden payload patterns, and documentation/code mismatch signals. Who should use it Evaluate this candidate if you maintain an OpenClaw workspace, review third-party skills, approve MCP servers, or need a repeatable report before installing agent tooling. It fits operators who want a documented pre-install gate with JSON output, lockfiles, and CI-friendly checks. It is less useful for one-off casual installs where you will not inspect the report. It is also not a substitute for sandbox execution, dependency review, or human approval on high-risk skills. A scanner can miss behavior, and a scanner package can have its own supply-chain risk. Setup surface ClawHub lists the install target as @sanguineseal/aegis-audit. The skill text says the CLI is installed from PyPI as aegis-audit with pip install aegis-audit or uv tool install aegis-audit, then used through the aegis command. The linked project source is https://github.com/Aegis-Scan/aegis-scan. Pricing classification: free. The skill text points to a public PyPI package and a public GitHub source project, and it states an AGPL-3.0 license. Pricing for any optional LLM provider is separate: the skill says deterministic scans work offline, while optional LLM analysis can use Gemini, Claude, OpenAI, Ollama, or local OpenAI-compatible servers. Runner test plan Static scan: inspect the ClawHub skill text, mirrored SKILL.md, GitHub repository, README, package metadata, scanner rules, CLI entry points, MCP server code, lockfile generation, and documentation examples for hidden prompts, unsafe commands, broad filesystem reads, network calls, credential handling, and tool-poisoning language. Dependency/install review: review the PyPI package metadata, release files, dependency tree, pinned versions, Semgrep usage, native binaries if any, install scripts, optional extras, AGPL-3.0 implications, and whether pip and uv install the same artifact. Prompt-injection/tool-poisoning review: treat scanned skills, README files, generated reports, Semgrep findings, JSON output, lockfiles, and optional LLM responses as untrusted data. Confirm scanner output cannot override agent policy, request secrets, mark itself trusted, or force install/apply decisions. Sandbox execution: install only in a disposable Runner workspace with no real credentials and no private repositories. Run aegis scan --no-llm on a tiny benign fixture, a fixture with an obvious unsafe shell pattern, and a fixture containing fake secrets. Then test aegis lock, aegis verify, JSON output, and failure behavior. Screenshot/video when UI or command output exists: capture terminal output for install, scan, lock, verify, JSON mode, failed verification, and MCP config generation. Capture any generated badge/report artifacts if present. Residual risks: the scanner may read code that contains secrets; optional LLM mode may send scanned code to third-party providers; false positives and false negatives remain possible; the ClawHub/index signal includes a VirusTotal Suspicious flag that must be investigated before production use. Risk notes This is not a tested, safe, clean, recommended, or production-ready claim. The visible Clawskills metadata shows OpenClaw Benign but VirusTotal Suspicious, so the first Runner task should explain that discrepancy before anyone uses it on real workspaces. Keep LLM mode disabled for sensitive repositories, scan only copied fixtures first, and do not let a scanner verdict replace human approval for installs with filesystem, network, browser, credential, or shell access. Source links Awesome OpenClaw Skills DevOps & Cloud category: https://raw.githubusercontent.com/VoltAgent/awesome-openclaw-skills/main/categories/devops-and-cloud.md ClawHub page: https://clawhub.ai/sanguineseal/aegis-audit Skill source mirror: https://clawskills.sh/skills-markdown/sanguineseal/aegis-audit.md Underlying GitHub source project: https://github.com/Aegis-Scan/aegis-scan PyPI package page: https://pypi.org/project/aegis-audit/
- LinkLoot access
- Free
- Provider costs
- Unknown
Review open
Next.js is moving to scheduled security releases. The first planned patch window targets July 20, 2026, with fixes for Next.js 16.2 and 15.5 covering 4 high and 5 medium severity issues. Use this as an upgrade-planning checkpoint, not as a CVE detail source until the final advisory lands. Use this official Next.js announcement to schedule upgrade work before the July 20, 2026 security release window. The post says the first scheduled release will include patch releases for Next.js 16.2 and 15.5, covering 4 high and 5 medium severity issues. Treat it as planning material until the final advisory publishes CVEs and affected ranges.
- LinkLoot access
- Free
- Provider costs
- Unknown
Review open
GitHub's Copilot app now exposes a /security-review command in public preview for scanning in-flight code changes. GitHub has added a /security-review slash command to the GitHub Copilot app, extending the security-focused review flow beyond the earlier Copilot CLI preview. Use it as a pre-PR or pre-merge check when a branch includes authentication, file upload, payment, dependency, or permission changes. What to try: Open a project in the Copilot app. Make or load the code changes you want reviewed. Run /security-review and inspect the findings before you create or merge a pull request. Keep normal SAST, dependency scanning, secret scanning, and human review in place. Limits to remember: GitHub labels the app command as public preview. Copilot code review availability depends on plan and organization policy. AI review can miss issues, especially in framework-specific flows or code paths that need runtime context. Treat findings as triage input, not as a release gate by itself.
- LinkLoot access
- Free
- Provider costs
- Unknown
Review open
Clawk gives Claude Code, Codex, and shell-based coding agents a disposable, network-restricted Linux VM so they can install tools and run code without direct access to your host machine. What it is Clawk is an open-source agent sandbox for local development. You start it from a repository, then run a coding agent or shell inside a disposable Linux VM with restricted outbound networking and only the mounted project files available. Why it is useful Use it when an agent needs to install packages, run servers, execute generated code, or inspect unfamiliar dependencies, but you do not want that work happening directly on your laptop. The project is pre-1.0, so treat it as a practical experiment rather than a hardened enterprise boundary. Best fit Use case Why Clawk helps Caveat --- --- --- Agent coding sessions Gives the agent root inside a throwaway Linux guest Anything mounted or allowed on the network can still be exposed Risky dependency tests Lets packages run away from the host filesystem You still need normal code review and secret hygiene Multi-agent experiments Keeps destructive commands away from the main machine Pre-1.0 project with possible breaking changes Before you try it Check the supported platforms, read the security model, and start with a non-sensitive repository. Do not mount secrets or private data unless you are comfortable with the agent and allowed network destinations seeing them.
- LinkLoot access
- Free
- Provider costs
- Unknown
Review open
GitHub's CodeQL 2.26.0 adds a JavaScript/TypeScript query that detects untrusted user values flowing into AI system prompts. CodeQL 2.26.0 is useful for teams shipping AI features in JavaScript or TypeScript. The release adds js/system-prompt-injection, a query for cases where untrusted user-provided values flow into an AI model's system prompt and can manipulate model behavior.\n\nWhy bookmark it: GitHub says every new CodeQL version is automatically deployed to GitHub code scanning users on github.com, so many teams can get the new query through existing security workflows instead of adding a separate scanner. The release also adds prompt-injection sinks for OpenAI, Anthropic, and Google GenAI SDK APIs, plus Kotlin 2.4.0 support and several query accuracy improvements.\n\nUse it for: AI app pull requests, agent backends, prompt-template libraries, Realtime session setup, and GenAI SDK integrations where user content might cross into system-level instructions.\n\nCheck before relying on it: whether your repo uses GitHub code scanning on github.com or a GitHub Enterprise Server version that includes CodeQL 2.26.0, whether the affected language pack runs in your workflow, and whether custom prompt-building helpers need extra modeling.
- LinkLoot access
- Free
- Provider costs
- Unknown
Review open
arc-trust-verifier helps review publisher, version, dependency, and attestation signals before installing a ClawHub skill. What it is arc-trust-verifier is a community OpenClaw skill for checking trust signals around ClawHub skills before you install or distribute them. Its listing says it analyzes publisher reputation, version consistency, content integrity, dependency chains, and signed attestations. Who should use it Use this as an evaluation candidate if you manage shared OpenClaw workspaces, test community skills, or need a repeatable pre-install review step for agents that can touch files, credentials, browsers, or external services. Setup surface The public listing shows install commands for OpenClaw CLI and ClawHub CLI, but this item is an editorial candidate only. Do not install it on a production OpenClaw host until you have reviewed the SKILL.md, scripts, dependency behavior, and registry metadata in a disposable environment. Risk notes The clawskills.sh page currently shows suspicious security signals from VirusTotal and OpenClaw status fields. Treat that as a reason to inspect the source carefully, not as a recommendation to run it. If you evaluate it, prefer a locked-down test workspace with no secrets and compare its claims against manual checks. Source links Awesome OpenClaw Skills lists arc-trust-verifier under Git & GitHub as a provenance and trust-score skill. clawskills.sh provides the public skill page, version notes, setup commands, and security status. ClawHub provides the registry page for the publisher and skill slug.
- LinkLoot access
- Free
- Provider costs
- Unknown
Review open
GitHub Advanced Security enterprise customers can now publish private innersource security advisories that trigger internal Dependabot alerts and fix PRs. GitHub innersource advisories are now generally available for enterprise security teams that need private vulnerability distribution inside one company. Use them when an internal package, shared service, or private fork has a flaw that should trigger Dependabot alerts and update pull requests without publishing the advisory to the public GitHub Advisory Database. The workflow is narrow and useful: create or withdraw advisories through the REST API, keep visibility scoped to the enterprise, and let Dependabot notify repositories that depend on the affected component. It is a fit for internal platforms, monorepos split into reusable packages, and regulated teams that need coordinated remediation before public disclosure. Check What to verify --- --- License Requires active GitHub Code Security or GitHub Advanced Security. Scope Advisories apply to the entire enterprise, not selected org groups. Limit Each enterprise can have up to 2,000 active innersource advisories. Automation Dependabot can create alerts and version update PRs for affected repos. Disclosure Advisory data stays private to the enterprise unless separately published. Treat this as a private remediation lane, not a replacement for public CVEs or external disclosure when customers or open-source users are affected.
- LinkLoot access
- Free
- Provider costs
- Unknown
Review open
Skill Vetter for OpenClaw Pre-Install Reviews
No votes yet
A ClawHub community skill that gives OpenClaw agents a repeatable checklist for reviewing untrusted skills before installation. What it does Skill Vetter is a compact OpenClaw review checklist for inspecting community skills before installation. It focuses on provenance, file scope, command scope, network behavior, credential access, obfuscation, and risk classification. The useful angle is not automation depth; it gives an agent a repeatable pre-installation review format before any untrusted skill runs. Who should use it Use it when an OpenClaw operator wants a lightweight gate before installing skills from ClawHub, GitHub, or a shared zip. It fits solo agents, small teams, and maintainers who need a consistent report format for community skill review. It is less useful if you already run a full sandboxed review pipeline with dependency scanning and execution tracing. Setup surface ClawHub lists the package as @fatfingererr/azhua-skill-vetter with install command openclaw skills install @fatfingererr/azhua-skill-vetter. The reachable source surface includes the ClawHub skill page, the direct SKILL.md file endpoint, and the ClawHub package download. No separate GitHub repository was visible from the reviewed pages. Treat the package as untrusted until Runner review finishes. Pricing: the ClawHub page shows MIT-0 license metadata and no paid gate, so this Loot is classified as free from available source evidence. Runner test plan Static scan: inspect every file in the downloaded skill package, including meta.json, skill-card.md, and SKILL.md. Dependency/install review: verify whether the package declares scripts, package files, shell helpers, or install-time side effects; compare that surface against the ClawHub metadata. Prompt-injection/tool-poisoning review: treat the skill text as untrusted content and check for instructions that override agent policy, request secrets, broaden file access, or force unsafe verdicts. Sandbox execution: install only in a disposable OpenClaw workspace with no real credentials, no production memory files, and network controls enabled. Screenshot/video: capture the install output and one sample vetting report if command output or UI evidence exists. Residual risks: ClawHub packages can change after publication, the visible source is registry-hosted rather than a GitHub repo with independent commit history, and the skill's own checklist language should not replace human approval for high-risk installs. Risk notes The candidate is security-themed, but that does not make it reviewed or safe. It includes suggested curl commands for GitHub-hosted skills; those should be treated as examples for a sandboxed reviewer, not commands to run blindly. The strongest limitation is source transparency: a direct SKILL.md path is reachable, but no underlying GitHub repository was visible during this pass. Source links Awesome OpenClaw Skills list: https://github.com/VoltAgent/awesome-openclaw-skills/blob/main/README.md?plain=1L240 ClawHub page: https://clawhub.ai/fatfingererr/azhua-skill-vetter Independent index page: https://clawskills.sh/skills/fatfingererr-azhua-skill-vetter Reachable SKILL.md source: https://clawhub.ai/api/v1/skills/azhua-skill-vetter/file?path=SKILL.md Reachable package download: https://wry-manatee-359.convex.site/api/v1/download?slug=azhua-skill-vetter
- LinkLoot access
- Free
- Provider costs
- Unknown
Review open
An OpenClaw Runner-review candidate for separating agent proposals from approved execution, with replay protection, receipts, and offline signature checks. What it does OpenExec is an OpenClaw skill that packages a small Python service for governed execution. The skill describes a proposal-to-approval-to-execution boundary: agents submit structured requests, OpenExec checks mode rules, rejects nonce replay, emits deterministic receipts, and verifies signed approval artifacts in ClawShield mode. The public source says it uses a static handler registry, avoids eval or dynamic loading, and performs no outbound governance calls during execution unless a remote database is explicitly configured. Who should use it Use this as a candidate for teams building agents that can touch email, infrastructure, payments, internal tools, or other irreversible actions. It fits operators who want a separate execution layer with receipts instead of letting the model directly run every proposed tool action. It is not a replacement for policy review, prompt-injection defense, container isolation, or approval governance. Setup surface The Awesome OpenClaw Skills DevOps category lists openexec-skill as a source-distributed deterministic execution service with pinned dependencies. ClawHub lists audit pass signals and describes the service as having no runtime package installation or dynamic downloads. The source tree exposes SKILL.md, SECURITY.md, README.md, main.py, requirements, tests, scripts, and configuration folders. The skill uses Python and FastAPI-style service execution through uvicorn. Pricing evidence: SKILL.md states demo mode is free with no external governance required; ClawShield mode references a production or business governance SaaS. Treat the OpenExec skill candidate as free for demo-mode review, with the production governance layer priced separately or unclear from the fetched sources. Runner test plan Static scan: inspect SKILL.md, README.md, SECURITY.md, main.py, requirements, tests, scripts, config, and handler registry files. Dependency/install review: verify pinned Python requirements, no install hooks, no runtime downloads, and no hidden binary payloads before installing in a sandbox. Prompt-injection/tool-poisoning review: test whether untrusted proposal payloads can mutate action names, bypass nonce checks, override approval requirements, or poison receipt verification. Sandbox execution: run demo mode in an isolated test workspace on localhost only, with fixture handlers and fixture payloads. Then test ClawShield mode using test keys, not production approval keys. Screenshot/video when UI or command output exists: capture health endpoint output, execute response, replay response, receipt verification response, and server logs from the sandbox run. No browser UI is expected. Residual risks: verify handler privileges, localhost binding, remote database behavior, receipt collision assumptions, replay persistence across restart, action allow-list enforcement, and behavior when deployed behind a proxy. Risk notes This is not a tested recommendation yet. OpenExec is an execution boundary, not an OS sandbox. Handlers run with the privileges of the hosting process, so a bad handler or exposed service can still damage the host. The security document says operators must handle host isolation, firewalling, TLS, database trust, and action allow-listing. The fetched GitHub HTML confirms main.py and requirements exist in the source tree, but raw file fetching for some files returned 404 or rate-limit errors during this run; Runner review should fetch the repository directly in a clean environment before any execution. Source links Awesome OpenClaw Skills DevOps category: https://github.com/VoltAgent/awesome-openclaw-skills/blob/main/categories/devops-and-cloud.md Clawskills listing: https://clawskills.sh/skills/trendinghot-openexec-skill ClawHub page: https://clawhub.ai/trendinghot/openexec-skill Source tree: https://github.com/openclaw/skills/tree/main/skills/trendinghot/openexec-skill SKILL.md source page: https://github.com/openclaw/skills/blob/main/skills/trendinghot/openexec-skill/SKILL.md SECURITY.md source page: https://github.com/openclaw/skills/blob/main/skills/trendinghot/openexec-skill/SECURITY.md
- LinkLoot access
- Free
- Provider costs
- Unknown
Review open
A practical self-hosting resource for exposing Docker apps inside a private Tailnet instead of opening router ports, reverse proxies, and public subdomains by default. What this is ScaleTail is a collection of ready-to-run Docker Compose stacks that attach common self-hosted apps to a Tailscale tailnet through a sidecar container. The useful idea is simple: make private tools reachable from your own devices without turning every dashboard, password vault, document archive, or admin panel into a public web service. Best use case Use this when you run services such as Vaultwarden, Paperless-ngx, Jellyfin, Immich, Pi-hole, AdGuard Home, Home Assistant, Open WebUI, Portainer, or Uptime Kuma and want remote access without a new router port, reverse-proxy rule, or public DNS entry for every app. Workflow Create a reusable Tailscale auth key in the Tailscale admin console. Pick the ScaleTail template matching your service. Review the Docker Compose file before running it, especially volumes, environment variables, and exposed ports. Bind the app container to the Tailscale sidecar network stack with the template's networkmode: service: pattern. Start the stack with Docker Compose and confirm the service appears in your Tailnet. Use Tailscale Serve for private Tailnet access. Only use Funnel when the service is intentionally public. Security notes ScaleTail reduces accidental public exposure, but it does not replace Docker hardening, backups, patching, or least-privilege access controls. Treat every template as code: inspect the image source, tags, volume mounts, environment variables, and update policy before production use. Keep admin panels, password managers, document stores, and local AI interfaces private unless you have a strong reason to expose them publicly. Do not confuse Tailscale Serve with Funnel: Serve is private to the Tailnet, while Funnel publishes a service to the public internet. Quick decision table Need Use ScaleTail? Caveat --- --- --- Private remote access to homelab apps Yes Requires Tailscale and Docker Compose Public webhook endpoint Maybe Funnel can be public; harden it carefully Full site publishing No Use a normal deployment and security model Multi-service homelab on one host Yes Still plan backups, updates, and separation Source check The Tarnkappe article explains the privacy angle, the Serve/Funnel distinction, and why ScaleTail fits self-hosted Docker services that should not be exposed publicly by default. The ScaleTail GitHub repository confirms that the project provides Docker Compose sidecar configurations for connecting self-hosted apps to a Tailnet. Tailscale's own Docker documentation provides the official baseline for running Tailscale with containers.
- LinkLoot access
- Free
- Provider costs
- Unknown
Review open
A free OpenClaw community skill candidate for keeping Agent Skill bundles traceable with manifests, changelogs, SHA-256 hashes, and stale-file checks across chat, CLI, IDE, and registry workflows. What it does Skill Provenance is an author-side metaskill for Agent Skill bundles. It documents a portable MANIFEST.yaml, CHANGELOG.md, per-file version metadata, and SHA-256 hash checks so a skill's SKILL.md, evals, scripts, references, and packaged copies can be tracked across sessions and platforms. The upstream source describes it as free and open with an MIT license. Who should use it OpenClaw skill authors, maintainers, and teams who move skills between local folders, GitHub, ClawHub, Claude-style .skill packages, Codex/Gemini-compatible strict copies, or multiple agent sessions. It is most useful when bundle drift, stale evals, renamed files, or unclear handoffs are a recurring problem. Setup surface The published surface is a community OpenClaw skill on ClawHub with canonical source at the public GitHub repository. The bundle includes SKILL.md, README.md, MANIFEST.yaml, CHANGELOG.md, eval files, validate.sh, and package.sh according to the fetched manifest. Treat installation commands and scripts in the source as review material only until Runner AI Review finishes. Pricing evidence from the upstream GitHub README states it is free and open; license evidence points to MIT. Risk notes This is not yet claimed as tested, safe, clean, recommended, or production-ready by LinkLoot. The concept relies on local file inventory and hash checks, but the upstream source itself notes that a manifest is not a cryptographic signature or trust anchor. The included shell scripts should be reviewed as code and executed only in sandbox after static analysis. Because the skill is designed to edit manifests/changelogs and package derived copies, Runner should verify it does not mutate unrelated files, read broad home/config/SSH paths, or follow embedded source instructions beyond the user's explicit task. Source links Awesome OpenClaw Skills list: https://github.com/VoltAgent/awesome-openclaw-skills and category listing https://raw.githubusercontent.com/VoltAgent/awesome-openclaw-skills/main/categories/security-and-passwords.md ClawHub page: https://clawhub.ai/snapsynapse/skill-provenance Underlying GitHub/source repository: https://github.com/snapsynapse/skill-provenance Source SKILL.md: https://raw.githubusercontent.com/snapsynapse/skill-provenance/main/skill-provenance/SKILL.md Source manifest: https://raw.githubusercontent.com/snapsynapse/skill-provenance/main/skill-provenance/MANIFEST.yaml
- LinkLoot access
- Free
- Provider costs
- Unknown
Review open
A practical defensive guide for checking your own codebase with AI agents: narrow scopes, parallel hunts, adversarial validation, reachability tracing, dedupe, gapfill, and governance gates. Built from the core operational lessons in Cloudflare's Project Glasswing write-up.
- LinkLoot access
- 29 Gems
- Provider costs
- Unknown
Review open
A community OpenClaw skill candidate that wraps GitGuardian ggshield so an agent can scan repositories, staged changes, files, and Docker images for leaked credentials before code is pushed. What it does The ggshield-scanner skill gives an OpenClaw-style agent a natural-language surface for GitGuardian's ggshield CLI. The source describes repository scans, single-file scans, staged-change checks, optional git hook installation, and Docker image scans for hardcoded secrets such as API keys, cloud credentials, private keys, OAuth tokens, and database passwords. Who should use it Developers, solo builders, and security-conscious agent operators who want an agent-assisted secret check before commits, pushes, releases, or Docker image handoff. It is especially useful for teams that already accept GitGuardian/ggshield in their workflow and want the agent to orchestrate checks rather than manually remembering every command. Setup surface The source indicates a Python-based skill that depends on ggshield and pygitguardian, requires a GitGuardian API key via GITGUARDIANAPIKEY, and calls the local ggshield binary. The public GitHub source is reachable, but the ClawHub/awesome-list OpenClaw tree link appears inconsistent with the reachable repository, so provenance should be reviewed carefully before any install. Pricing evidence in the source says GitGuardian signup is free, with enterprise/on-premise options mentioned separately; classify this Loot as free with that caveat. Risk notes Do not install or run directly on a production Raspberry Pi or personal workspace before Runner review artifacts exist. The implementation shown uses subprocess calls to ggshield with argument arrays rather than shell=True, which is a good sign, but it still executes a local binary and can scan sensitive paths if the agent is allowed to choose broad inputs. The hook installer changes git repository state. Review privacy claims against current GitGuardian documentation before scanning private code. Source links Awesome OpenClaw Skills list: https://github.com/VoltAgent/awesome-openclaw-skills Awesome category entry: https://raw.githubusercontent.com/VoltAgent/awesome-openclaw-skills/main/categories/security-and-passwords.md ClawHub page: https://clawhub.ai/amascia-gg/ggshield-scanner Reachable source repository: https://github.com/GitGuardian/ggshield-skill Source SKILL.md: https://raw.githubusercontent.com/GitGuardian/ggshield-skill/main/SKILL.md
- LinkLoot access
- Free
- Provider costs
- Unknown
Review open
Blog
Related reads
Tools & Apps
CISA adds SharePoint code-injection CVE with a September 28 deadline
CISA added CVE-2026-65660 in Microsoft SharePoint to its Known Exploited Vulnerabilities catalog on September 25, giving covered federal age…
Tools & Apps
CVE-2026-87902 enters CISA KEV with WordPress patch deadline
CISA added WordPress Core CVE-2026-87902 to its KEV catalog on September 25, with a September 28 remediation deadline for covered federal ag…
Tools & Apps
Supabase rolls out PostgreSQL 15.19 and 17.11 with 44 CVE fixes
Supabase is rolling out PostgreSQL 15.19 and 17.11 after five upstream security cycles. Existing projects should prepare for the September 2…
Tools & Apps
Cloudflare makes MCP server portals generally available with DLP controls
Cloudflare has made MCP server portals generally available, adding a governed endpoint for approved servers with Access, Gateway routing, DL…
Tools & Apps
GitHub adds proof-of-presence checks for high-impact actions
GitHub Enterprise Cloud now lets eligible Entra-backed enterprises require fresh re-authentication or MFA before sensitive administrative ac…
Tools & Apps
GitHub sets October 14 SSH key deadline and November 4 brownout
GitHub will require new RSA SSH keys to be at least 3072 bits from October 14 and will brown out SHA-1 RSA signatures and an older Diffie-He…
Tools & Apps
CVE-2026-71362 is exploited; Adobe Commerce teams face a September 27 deadline
CISA added CVE-2026-71362 to its Known Exploited Vulnerabilities Catalog on September 24. Adobe Commerce, Commerce B2B, and Magento Open Sou…
Tools & Apps
CISA gives Zyxel GS1900 owners a September 24 patch deadline
CISA lists CVE-2026-7273 in its Known Exploited Vulnerabilities Catalog with a September 24 remediation deadline; Zyxel has released firmwar…
Tools & Apps
Check Point Management Servers face active CVE-2026-93616 attacks
CVE-2026-93616 lets unauthenticated attackers upload and execute scripts on affected Check Point Management Servers. CISA lists active explo…
Tools & Apps
GitHub Copilot app adds centrally managed OpenTelemetry export
GitHub now lets enterprise administrators configure OpenTelemetry export for the Copilot app, giving teams centralized visibility into agent…
Tools & Apps
Cisco ISE CVE-2026-76460 is under active exploitation
Cisco says an unauthenticated API flaw in Identity Services Engine is being actively exploited and has no workaround.
Tools & Apps
Cloudflare moves Next.js RCE defenses into baseline WAF rules
Cloudflare has promoted two Next.js remote-code-execution detections from beta into baseline managed WAF signatures. The change strengthens …
Tools & Apps
GitHub CLI Linux package key expires September 5
GitHub's current PGP key for Linux package repositories expires on September 5, 2026. Older apt, yum, and dnf installations should refresh t…
AI & Automation
Claude Code 2.1.257 adds Fable 5.1 and tighter agent safeguards
Claude Code 2.1.257 makes Fable 5.1 the default model and adds stricter controls around metadata access, network paths, credentials, MCP ser…
Tools & Apps
Next.js 15.5.24 and 16.3.3 close two critical RCE paths
Next.js shipped 15.5.24 and 16.3.3 after disclosing a critical Windows-hosted RCE and a separate AVIF image-optimization RCE path.
Tools & Apps
Two critical Next.js RCE flaws are fixed in 15.5.24 and 16.3.3
Next.js has patched two critical unauthenticated remote-code-execution paths affecting AVIF image processing and certain Windows-hosted appl…
Tools & Apps
Oracle ships record July CPU with 1,449 security patches
Oracle's July 2026 Critical Patch Update is its largest security release to date, covering 1,449 patches across 334 products and giving Orac…
Tools & Apps
Suno breach exposes 55M accounts as HIBP confirms dataset
Have I Been Pwned has added Suno's November 2025 breach, listing more than 55 million unique email addresses plus phone numbers and a smalle…
Tools & Apps
Vercel WAF now protects Blob stores in beta
Vercel has extended its Web Application Firewall to Vercel Blob stores in beta, letting teams apply deny, challenge, and rate-limit rules to…
Tools & Apps
PAN-OS GlobalProtect flaw now leads to Qilin ransomware intrusions
Arctic Wolf says CVE-2026-0257 has moved from observed GlobalProtect exploitation to Qilin ransomware intrusions, giving PAN-OS administrato…
Tools & Apps
Anthropic brings Claude Security scans to Claude Code beta
Anthropic's Claude Security plugin is now documented for Claude Code, adding multi-agent repository scans, diff scans, and reviewed patch fi…
Tools & Apps
Next.js patches July security flaws across App Router and Server Actions
Next.js released v16.2.11 and v15.5.21 to fix July 2026 security issues across App Router, Server Actions, middleware/proxy behavior, SSRF p…
Tools & Apps
Node.js schedules HIGH-severity security releases for July 27
The Node.js project says security releases for the 26.x, 24.x, and 22.x lines are due on or shortly after July 27, 2026, with the highest se…
Tools & Apps
CISA puts WordPress wp2shell RCE in KEV with July 24 deadline
CISA now lists two WordPress Core wp2shell vulnerabilities as actively exploited, with a July 24 deadline for CVE-2026-63030 and an August 4…
Tools & Apps
GitHub puts Copilot code review behind a default firewall
GitHub now gives Copilot code review its own firewall, setup workflow, and runner configuration, separating review-agent controls from the b…
Tools & Apps
Fortinet FortiSandbox CVEs enter CISA KEV with July 19 deadline
CISA added two Fortinet FortiSandbox command-injection flaws to KEV on July 16, with a July 19 remediation deadline for covered agencies and…
AI & Automation
Claude Code 2.1.214 fixes permission bypasses in agent shell checks
Anthropic's July 18 Claude Code update closes several permission-check gaps around Windows PowerShell 5.1, Bash parsing, long shell commands…
Tools & Apps
Cloudflare ships emergency WAF rules for active RCE and SQLi attacks
Cloudflare's July 17 emergency WAF release adds block-mode detections for active unauthenticated RCE and SQL injection exploitation in popul…
Tools & Apps
WordPress 7.0.2 forces security updates for wp2shell RCE
WordPress 7.0.2 fixes one critical and one high-severity core issue, with forced automatic updates enabled for affected branches and Cloudfl…
Tools & Apps
SharePoint CVE-2026-58644 is exploited; admins face a July 19 deadline
CISA and NVD now mark CVE-2026-58644 as actively exploited against Microsoft SharePoint Server, with emergency remediation pressure on expos…