Topic
#Security
Loot, blog posts and adjacent themes connected to this topic. Follow the tag to keep it in your orbit.
Loot
More from this topic
ByteDance’s UI-TARS Desktop is one of the most interesting open-source computer-use agents right now: it sees your screen, clicks, types, and works across desktop and browser tasks. The important nuance is security: the app can feel local-first, but privacy depends on how you host the model and whether you disable optional telemetry and report upload flows. UI-TARS Desktop is not just another agent demo. It is a real open-source desktop automation app that can watch the screen, move the mouse, type, and complete GUI tasks through natural-language instructions. At the time of writing, the repo sits at 30.7k+ GitHub stars, which explains why it is suddenly everywhere. What it actually offers local computer operator for desktop tasks browser operator mode for web workflows natural-language control powered by a vision-language model screenshot understanding plus mouse and keyboard execution official quick-start docs, settings docs, and public showcase clips Apache-2.0 licensed repo with the UI-TARS research paper behind it Security reality check The viral pitch says “runs 100% locally,” but the practical answer is more nuanced. The official docs show the desktop app connecting to external or self-hosted OpenAI-compatible model endpoints such as Hugging Face or VolcEngine. So the GUI control can be local, but privacy depends on where your model inference happens. Here is the more useful security read: good: the app itself is open source and the main operator runs on your own machine good: the project has a public security policy and a formal vulnerability-report path good: official docs surface permission requirements clearly, especially screen recording and accessibility on macOS watch out: optional report upload docs explicitly note there is currently no authentication designed for the report storage server watch out: the UTIO event endpoint can receive app launch, instruction, and share-report events if you configure it watch out: if you point the app at hosted inference endpoints, your screenshots and task context may leave the machine depending on that backend watch out: the current docs also note single-monitor assumptions and remote-operator history, so this is not a zero-risk “install and forget” tool Best practices before you trust it with real work Where it looks genuinely useful repetitive desktop QA flows browser-side task automation without building a custom script for every site controlled internal demos of computer-use agents research and evaluation against GUI benchmarks experimentation with open-source alternatives to expensive proprietary computer-use stacks Official showcase and app screens UI-TARS Desktop app screen UI-TARS Desktop settings screen The official README also links showcase clips for: changing VS Code autosave settings with the local operator checking the latest GitHub issue with the agent remote operator demos for desktop and browser workflows Why this repo matters The underlying UI-TARS paper claims state-of-the-art benchmark performance across GUI-agent tasks, including stronger numbers than several well-known closed-model baselines in parts of OSWorld and AndroidWorld. That does not automatically mean better production reliability, but it does make the repo more than just hype. My bottom line UI-TARS Desktop is one of the best open-source computer-use projects to watch right now because it combines a real app, public docs, showcase examples, and a research-backed model story. Just do not repeat the lazy “100% local” claim without the important qualifier: it is only as private as the endpoint and integrations you configure.
Free
Review open
qsa.sh gives VPS and server operators a quick outside-in security scan of the public IP they are connecting from, with a free tier and paid deeper scans. qsa.sh is a practical terminal-first security checker for people who run their own servers and want a quick view of what the public internet can see. Run curl https://qsa.sh from the server you control and the service scans the public IP behind that request. The free scan covers common ports and selected vulnerability checks, then streams results back to the terminal. That makes it useful for quick VPS hygiene checks after deploying a new machine, changing firewall rules, moving behind a tunnel, or auditing a small self-hosted service. The key constraint is also the safety feature: there is no arbitrary target box. qsa.sh scans the IP that connects to it, gives a short abort window before work begins, and says it refuses common shared-network cases such as mobile-carrier, CGNAT, VPN, Tor, and proxy origins on a best-effort basis. Use it only on infrastructure you are authorized to scan. Pricing/access visible on the source page: Free: common-port live scan with naabu, nmap plus vulners, and a curated nuclei set. Full: paid monthly deeper port coverage. Deep: paid one-time full nuclei-style report. Practical use cases: Verify that a fresh VPS exposes only the services you expect. Re-check a host after changing Docker, firewall, Cloudflared, or reverse-proxy rules. Keep a lightweight manual audit step before publishing a self-hosted app. Compare the free scan with your own local nmap/nuclei workflow before paying for deeper reports. Caveats: this is not a full penetration test, the wrapper service itself is not presented as open source, and any security scan can produce false positives or miss issues. Treat the output as a fast triage signal, not as proof that a host is safe.
Free
Review open
Text: AI-generated
AI-generated · Automatically published by LinkLoot. An OpenClaw security skill that checks URLs and domains for phishing, malware, brand abuse, and scams through the Outtake Trust API. Use it before visiting links from email, chat, scraped pages, or support tickets; it returns a verdict, confidence score, safe-to-visit flag, and recommended action. Requires an OUTTAKEAPIKEY. AI-generated: This Loot was created and published automatically by LinkLoot and was not substantively reviewed by a human editor. Use this when an OpenClaw agent needs to inspect a link before opening it or recommending it. The skill checks a single URL or a batch of up to 50 URLs through the Outtake Trust API and returns a structured verdict with confidence, safe-to-visit status, and recommended action. Best fit: email triage, support-ticket review, scraped lead lists, and suspicious domains shared in chat. Requires an OUTTAKEAPIKEY.
Free
Review open
OneCLI is an open-source credential gateway that lets agents call services through placeholder keys while the gateway injects real secrets at request time. OneCLI is worth evaluating if your agents need API access but you do not want raw keys sitting in prompts, project files, shell history, or agent memory. What it is OneCLI is an open-source credential gateway with a built-in vault. You store real API credentials once, give an agent a placeholder key, and route outbound HTTP calls through OneCLI. The gateway matches the target host and path, decrypts the right secret, and injects it into the request so the agent never sees the real credential. The repository describes a Rust gateway, a Next.js dashboard, AES-256-GCM encrypted storage, host/path matching, per-agent access tokens, and optional Bitwarden-style vault integration. Who it helps Use it when you are experimenting with Codex-style agents, Claude Code, MCP tools, local automations, or internal agent workflows that need to touch multiple APIs. The cleanest fit is a local or small-team setup where credential exposure is the main risk and you want one place to rotate keys, scope agent access, and inspect what each agent is doing. How to evaluate it Start in a throwaway local workspace. Read the README, inspect the Docker compose setup, review how secrets are encrypted, and test with a non-critical API token first. Confirm whether the gateway behavior fits your agent stack before connecting production accounts. Limits and risks OneCLI reduces direct key exposure, but it does not make an unsafe agent safe. A compromised or prompt-injected agent may still call allowed services through the gateway. You still need scoped API keys, logging, rate limits, approval gates for destructive actions, and a clear rotation plan. The HTTPS interception model also deserves careful review before team or production use. Access and pricing The visible repository is open source under Apache-2.0. The project also links to a website and docs; check the current hosted or team offering separately if you need managed deployment. Sources OneCLI GitHub repository OneCLI website
Free
Review open
A self-hosted security research workbench that turns Codex or Claude Code agents into focused, de-duplicated vulnerability scans. open-kritt is a self-hosted security research platform for developers and bug-bounty teams that want AI agents to inspect code in smaller, repeatable workflows instead of asking one model to audit an entire repository at once. It lets you build prompt-based scan workflows, run them with Codex or Claude Code, validate findings with post-scripts, rank severity, and de-duplicate results before review. Why it is useful: It is aimed at practical code-security work: scoped scans, reusable workflows, findings, ranking, and proof-building rather than generic chat. It supports model access through Codex, OpenAI, Anthropic, or OpenRouter, so teams can choose the provider path that fits their setup. The project is open source under AGPL-3.0 and includes a local Docker Compose stack plus a repository-local ./kritt CLI. Use it carefully. The project documentation states that tool-enabled scan agents run as root inside disposable containers with writable repository copies and direct internet access. The backend is unauthenticated by default. That makes open-kritt best suited for a dedicated VM or isolated Docker host, with scoped credentials and network controls, especially when scanning untrusted or private repositories. A good first evaluation path is to read the threat model, clone the repository on an isolated machine, run ./kritt setup, configure one model-access option, and scan a small non-sensitive repository before connecting private code.
Free
Review open
Agent Passport is an OpenClaw skill candidate for scoped mandates, action checks, spending caps, allowlists, and audit logs before agents take sensitive actions. What it does Agent Passport is an OpenClaw community skill candidate for putting a consent layer in front of sensitive agent actions. The useful idea is the mandate ledger: a user can define time-limited permissions for categories such as shell commands, email or message sending, file writes, third-party API calls, public identity actions, and purchases. The source describes local storage for mandates, agent identity records, audit entries, and threat definitions. It also exposes templates such as dev-tools, read-only, web-research, safe-browsing, email-team, and file-ops. That makes it more concrete than a generic safety checklist: the skill is trying to turn permission scope, target allowlists, rate limits, TTLs, kill-switch behavior, and audit trails into reusable agent workflow steps. Pricing/access note: the public source shows a free local mode. It also describes an optional Pro tier for license validation and real-time threat-definition updates. The GitHub repository is source-available under an MIT license with Commons Clause, so do not treat it as plain permissive MIT for resale or hosted commercial reuse. Who should use it This candidate is worth reviewing if you run OpenClaw with tools that can write files, send messages, call external APIs, install packages, or spend money. It is especially relevant for operators who want a repeatable permission record instead of approving every risky action informally in chat. Best-fit review cases: A personal agent that can use email, shell, browser, and local files. A team agent where actions need audit notes after execution. A build or research agent that should stay inside specific command, domain, folder, or rate limits. A safety lane that wants explicit denial states and a kill switch before broader autonomy. Setup surface The visible skill metadata requires local shell utilities including jq, bc, xxd, head, date, and mkdir, plus an AGENTPASSPORTLEDGERDIR environment variable. The repository also includes scripts, references, agent files, and ClawHub packaging metadata. Reviewers should inspect the full repository, not just SKILL.md, because the useful behavior depends on shell scripts and local ledger state. Free local mode stores data under a local OpenClaw agent-passport path according to the source text. The optional Pro path introduces network calls to api.agentpassportai.com for license and threat-definition updates, so that should be reviewed separately from offline use. Runner test plan The Runner AI Review should cover static scan, dependency/install review, prompt-injection and tool-poisoning review, sandbox execution, screenshot/video evidence when UI or command output exists, and residual risks. Minimum checks: Static scan: read SKILL.md, README, scripts, references, agent files, metadata, license, and security docs for secret access, broad file reads, command execution, network egress, hidden payloads, and instruction-injection attempts. Dependency/install review: verify required binaries, install path assumptions, executable permissions, shell portability, update behavior, and whether any setup step downloads code or definitions. Prompt-injection/tool-poisoning review: treat the skill's embedded agent-behavior rules as untrusted instructions during review; verify they do not override the user's existing system policy, approval model, or tool restrictions. Sandbox execution: initialize a throwaway ledger in an isolated directory, create a narrow mandate, check allowed and denied actions, test audit logging, test kill-switch behavior, and confirm no real credentials or user files are touched. Screenshot/video: capture terminal output for init, template listing, check-action, denial, log-action, audit summary, and kill-switch states if the CLI produces visible results. Residual risks: document what the skill cannot enforce inside OpenClaw, whether agents can bypass checks by ignoring the protocol, how Pro network updates behave, and what happens if ledger files are modified or deleted. Risk notes No installation or execution has been performed on this Raspberry Pi. This Loot is a review candidate, not a safety endorsement. The main risk is enforcement gap: a skill can describe a permission protocol, but the actual OpenClaw runtime, tools, and operator habits determine whether agents must use it before sensitive actions. Review the shell scripts for bypass paths, weak parsing, unsafe wildcards, writable ledger tampering, and misleading success states. The source also contains direct instructions aimed at agents. Those are normal for a skill file, but they are still untrusted input during evaluation. A reviewer should quote and assess them, not obey them. Source links Awesome OpenClaw Skills list: https://github.com/VoltAgent/awesome-openclaw-skills/blob/main/categories/web-and-frontend-development.md ClawHub page: https://clawhub.ai/markneville/agent-passport Clawskills listing: https://clawskills.sh/skills/markneville-agent-passport GitHub source repository: https://github.com/agentpassportai/agent-passport Direct SKILL.md source: https://raw.githubusercontent.com/agentpassportai/agent-passport/main/SKILL.md
Free
Review open
Agentgate gives OpenClaw agents a controlled API gateway for personal services, with immediate reads and approval-queued writes. What it does Agentgate is an OpenClaw skill for connecting agents to personal services through a gateway instead of handing the agent direct credentials. Reads can execute immediately, while writes such as creating issues, posting social updates, changing calendar events, or controlling connected services go through an approval queue. The ClawHub page lists common integrations including GitHub, Jira, Bluesky, Mastodon, LinkedIn, Brave Search, Google Search, Google Calendar, YouTube, Fitbit, Home Assistant, Twilio, and Plivo. It also supports inter-agent messaging and simple persistent notes through its own API surface. Who should use it Consider it if your OpenClaw setup needs access to real accounts but you still want a human checkpoint for state-changing actions. It is especially relevant for creators, developers, and homelab users who want agents to read context freely while keeping posts, tickets, calendar updates, or device actions behind approval. Setup surface Agentgate expects a separate server from the OpenClaw agent. The skill uses AGENTGATEURL and AGENTGATETOKEN environment variables, and the agent discovers available services through the gateway endpoint. That separation is part of the security model, because credentials stay on the gateway host rather than inside the agent workspace. Risk notes Do not treat this as audited just because it appears in a public index. Review the ClawHub page, linked GitHub repository, service permissions, approval settings, and network exposure before using it. Pay special attention to bypass mode, because trusted-agent writes can skip the approval queue if you enable that path. Sources Awesome OpenClaw Skills: https://github.com/VoltAgent/awesome-openclaw-skills ClawHub listing: https://clawhub.ai/monteslu/skills/agentgate Skill mirror: https://clawskills.sh/skills/monteslu-agentgate Project source: https://github.com/monteslu/agentgate
Free
Review open
A community OpenClaw skill candidate for static review, capability mapping, risk scoring, and lockfile checks before trusting agent skills or MCP tools. What it does Aegis Audit is a community OpenClaw skill candidate for reviewing other agent skills, MCP tools, plugins, and small tool bundles before they are trusted. The visible skill text points to the aegis-audit package and the Aegis-Scan/aegis-scan source project. Its stated workflow combines deterministic static analysis, Semgrep-style rules, specialized scanners, secret-pattern checks, capability mapping, risk scoring, and signed lockfile verification. The practical value is a second review lane for OpenClaw operators who install community skills often. Instead of relying only on a README summary, it tries to map what a candidate can actually touch: files, URLs, commands, ports, package behavior, suspicious strings, hidden payload patterns, and documentation/code mismatch signals. Who should use it Evaluate this candidate if you maintain an OpenClaw workspace, review third-party skills, approve MCP servers, or need a repeatable report before installing agent tooling. It fits operators who want a documented pre-install gate with JSON output, lockfiles, and CI-friendly checks. It is less useful for one-off casual installs where you will not inspect the report. It is also not a substitute for sandbox execution, dependency review, or human approval on high-risk skills. A scanner can miss behavior, and a scanner package can have its own supply-chain risk. Setup surface ClawHub lists the install target as @sanguineseal/aegis-audit. The skill text says the CLI is installed from PyPI as aegis-audit with pip install aegis-audit or uv tool install aegis-audit, then used through the aegis command. The linked project source is https://github.com/Aegis-Scan/aegis-scan. Pricing classification: free. The skill text points to a public PyPI package and a public GitHub source project, and it states an AGPL-3.0 license. Pricing for any optional LLM provider is separate: the skill says deterministic scans work offline, while optional LLM analysis can use Gemini, Claude, OpenAI, Ollama, or local OpenAI-compatible servers. Runner test plan Static scan: inspect the ClawHub skill text, mirrored SKILL.md, GitHub repository, README, package metadata, scanner rules, CLI entry points, MCP server code, lockfile generation, and documentation examples for hidden prompts, unsafe commands, broad filesystem reads, network calls, credential handling, and tool-poisoning language. Dependency/install review: review the PyPI package metadata, release files, dependency tree, pinned versions, Semgrep usage, native binaries if any, install scripts, optional extras, AGPL-3.0 implications, and whether pip and uv install the same artifact. Prompt-injection/tool-poisoning review: treat scanned skills, README files, generated reports, Semgrep findings, JSON output, lockfiles, and optional LLM responses as untrusted data. Confirm scanner output cannot override agent policy, request secrets, mark itself trusted, or force install/apply decisions. Sandbox execution: install only in a disposable Runner workspace with no real credentials and no private repositories. Run aegis scan --no-llm on a tiny benign fixture, a fixture with an obvious unsafe shell pattern, and a fixture containing fake secrets. Then test aegis lock, aegis verify, JSON output, and failure behavior. Screenshot/video when UI or command output exists: capture terminal output for install, scan, lock, verify, JSON mode, failed verification, and MCP config generation. Capture any generated badge/report artifacts if present. Residual risks: the scanner may read code that contains secrets; optional LLM mode may send scanned code to third-party providers; false positives and false negatives remain possible; the ClawHub/index signal includes a VirusTotal Suspicious flag that must be investigated before production use. Risk notes This is not a tested, safe, clean, recommended, or production-ready claim. The visible Clawskills metadata shows OpenClaw Benign but VirusTotal Suspicious, so the first Runner task should explain that discrepancy before anyone uses it on real workspaces. Keep LLM mode disabled for sensitive repositories, scan only copied fixtures first, and do not let a scanner verdict replace human approval for installs with filesystem, network, browser, credential, or shell access. Source links Awesome OpenClaw Skills DevOps & Cloud category: https://raw.githubusercontent.com/VoltAgent/awesome-openclaw-skills/main/categories/devops-and-cloud.md ClawHub page: https://clawhub.ai/sanguineseal/aegis-audit Skill source mirror: https://clawskills.sh/skills-markdown/sanguineseal/aegis-audit.md Underlying GitHub source project: https://github.com/Aegis-Scan/aegis-scan PyPI package page: https://pypi.org/project/aegis-audit/
Free
Review open
Next.js is moving to scheduled security releases. The first planned patch window targets July 20, 2026, with fixes for Next.js 16.2 and 15.5 covering 4 high and 5 medium severity issues. Use this as an upgrade-planning checkpoint, not as a CVE detail source until the final advisory lands. Use this official Next.js announcement to schedule upgrade work before the July 20, 2026 security release window. The post says the first scheduled release will include patch releases for Next.js 16.2 and 15.5, covering 4 high and 5 medium severity issues. Treat it as planning material until the final advisory publishes CVEs and affected ranges.
Free
Review open
GitHub's Copilot app now exposes a /security-review command in public preview for scanning in-flight code changes. GitHub has added a /security-review slash command to the GitHub Copilot app, extending the security-focused review flow beyond the earlier Copilot CLI preview. Use it as a pre-PR or pre-merge check when a branch includes authentication, file upload, payment, dependency, or permission changes. What to try: Open a project in the Copilot app. Make or load the code changes you want reviewed. Run /security-review and inspect the findings before you create or merge a pull request. Keep normal SAST, dependency scanning, secret scanning, and human review in place. Limits to remember: GitHub labels the app command as public preview. Copilot code review availability depends on plan and organization policy. AI review can miss issues, especially in framework-specific flows or code paths that need runtime context. Treat findings as triage input, not as a release gate by itself.
Free
Review open
Clawk gives Claude Code, Codex, and shell-based coding agents a disposable, network-restricted Linux VM so they can install tools and run code without direct access to your host machine. What it is Clawk is an open-source agent sandbox for local development. You start it from a repository, then run a coding agent or shell inside a disposable Linux VM with restricted outbound networking and only the mounted project files available. Why it is useful Use it when an agent needs to install packages, run servers, execute generated code, or inspect unfamiliar dependencies, but you do not want that work happening directly on your laptop. The project is pre-1.0, so treat it as a practical experiment rather than a hardened enterprise boundary. Best fit Use case Why Clawk helps Caveat --- --- --- Agent coding sessions Gives the agent root inside a throwaway Linux guest Anything mounted or allowed on the network can still be exposed Risky dependency tests Lets packages run away from the host filesystem You still need normal code review and secret hygiene Multi-agent experiments Keeps destructive commands away from the main machine Pre-1.0 project with possible breaking changes Before you try it Check the supported platforms, read the security model, and start with a non-sensitive repository. Do not mount secrets or private data unless you are comfortable with the agent and allowed network destinations seeing them.
Free
Review open
GitHub's CodeQL 2.26.0 adds a JavaScript/TypeScript query that detects untrusted user values flowing into AI system prompts. CodeQL 2.26.0 is useful for teams shipping AI features in JavaScript or TypeScript. The release adds js/system-prompt-injection, a query for cases where untrusted user-provided values flow into an AI model's system prompt and can manipulate model behavior.\n\nWhy bookmark it: GitHub says every new CodeQL version is automatically deployed to GitHub code scanning users on github.com, so many teams can get the new query through existing security workflows instead of adding a separate scanner. The release also adds prompt-injection sinks for OpenAI, Anthropic, and Google GenAI SDK APIs, plus Kotlin 2.4.0 support and several query accuracy improvements.\n\nUse it for: AI app pull requests, agent backends, prompt-template libraries, Realtime session setup, and GenAI SDK integrations where user content might cross into system-level instructions.\n\nCheck before relying on it: whether your repo uses GitHub code scanning on github.com or a GitHub Enterprise Server version that includes CodeQL 2.26.0, whether the affected language pack runs in your workflow, and whether custom prompt-building helpers need extra modeling.
Free
Review open
arc-trust-verifier helps review publisher, version, dependency, and attestation signals before installing a ClawHub skill. What it is arc-trust-verifier is a community OpenClaw skill for checking trust signals around ClawHub skills before you install or distribute them. Its listing says it analyzes publisher reputation, version consistency, content integrity, dependency chains, and signed attestations. Who should use it Use this as an evaluation candidate if you manage shared OpenClaw workspaces, test community skills, or need a repeatable pre-install review step for agents that can touch files, credentials, browsers, or external services. Setup surface The public listing shows install commands for OpenClaw CLI and ClawHub CLI, but this item is an editorial candidate only. Do not install it on a production OpenClaw host until you have reviewed the SKILL.md, scripts, dependency behavior, and registry metadata in a disposable environment. Risk notes The clawskills.sh page currently shows suspicious security signals from VirusTotal and OpenClaw status fields. Treat that as a reason to inspect the source carefully, not as a recommendation to run it. If you evaluate it, prefer a locked-down test workspace with no secrets and compare its claims against manual checks. Source links Awesome OpenClaw Skills lists arc-trust-verifier under Git & GitHub as a provenance and trust-score skill. clawskills.sh provides the public skill page, version notes, setup commands, and security status. ClawHub provides the registry page for the publisher and skill slug.
Free
Review open
GitHub Advanced Security enterprise customers can now publish private innersource security advisories that trigger internal Dependabot alerts and fix PRs. GitHub innersource advisories are now generally available for enterprise security teams that need private vulnerability distribution inside one company. Use them when an internal package, shared service, or private fork has a flaw that should trigger Dependabot alerts and update pull requests without publishing the advisory to the public GitHub Advisory Database. The workflow is narrow and useful: create or withdraw advisories through the REST API, keep visibility scoped to the enterprise, and let Dependabot notify repositories that depend on the affected component. It is a fit for internal platforms, monorepos split into reusable packages, and regulated teams that need coordinated remediation before public disclosure. Check What to verify --- --- License Requires active GitHub Code Security or GitHub Advanced Security. Scope Advisories apply to the entire enterprise, not selected org groups. Limit Each enterprise can have up to 2,000 active innersource advisories. Automation Dependabot can create alerts and version update PRs for affected repos. Disclosure Advisory data stays private to the enterprise unless separately published. Treat this as a private remediation lane, not a replacement for public CVEs or external disclosure when customers or open-source users are affected.
Free
Review open
A ClawHub community skill that gives OpenClaw agents a repeatable checklist for reviewing untrusted skills before installation. What it does Skill Vetter is a compact OpenClaw review checklist for inspecting community skills before installation. It focuses on provenance, file scope, command scope, network behavior, credential access, obfuscation, and risk classification. The useful angle is not automation depth; it gives an agent a repeatable pre-installation review format before any untrusted skill runs. Who should use it Use it when an OpenClaw operator wants a lightweight gate before installing skills from ClawHub, GitHub, or a shared zip. It fits solo agents, small teams, and maintainers who need a consistent report format for community skill review. It is less useful if you already run a full sandboxed review pipeline with dependency scanning and execution tracing. Setup surface ClawHub lists the package as @fatfingererr/azhua-skill-vetter with install command openclaw skills install @fatfingererr/azhua-skill-vetter. The reachable source surface includes the ClawHub skill page, the direct SKILL.md file endpoint, and the ClawHub package download. No separate GitHub repository was visible from the reviewed pages. Treat the package as untrusted until Runner review finishes. Pricing: the ClawHub page shows MIT-0 license metadata and no paid gate, so this Loot is classified as free from available source evidence. Runner test plan Static scan: inspect every file in the downloaded skill package, including meta.json, skill-card.md, and SKILL.md. Dependency/install review: verify whether the package declares scripts, package files, shell helpers, or install-time side effects; compare that surface against the ClawHub metadata. Prompt-injection/tool-poisoning review: treat the skill text as untrusted content and check for instructions that override agent policy, request secrets, broaden file access, or force unsafe verdicts. Sandbox execution: install only in a disposable OpenClaw workspace with no real credentials, no production memory files, and network controls enabled. Screenshot/video: capture the install output and one sample vetting report if command output or UI evidence exists. Residual risks: ClawHub packages can change after publication, the visible source is registry-hosted rather than a GitHub repo with independent commit history, and the skill's own checklist language should not replace human approval for high-risk installs. Risk notes The candidate is security-themed, but that does not make it reviewed or safe. It includes suggested curl commands for GitHub-hosted skills; those should be treated as examples for a sandboxed reviewer, not commands to run blindly. The strongest limitation is source transparency: a direct SKILL.md path is reachable, but no underlying GitHub repository was visible during this pass. Source links Awesome OpenClaw Skills list: https://github.com/VoltAgent/awesome-openclaw-skills/blob/main/README.md?plain=1L240 ClawHub page: https://clawhub.ai/fatfingererr/azhua-skill-vetter Independent index page: https://clawskills.sh/skills/fatfingererr-azhua-skill-vetter Reachable SKILL.md source: https://clawhub.ai/api/v1/skills/azhua-skill-vetter/file?path=SKILL.md Reachable package download: https://wry-manatee-359.convex.site/api/v1/download?slug=azhua-skill-vetter
Free
Review open
An OpenClaw Runner-review candidate for separating agent proposals from approved execution, with replay protection, receipts, and offline signature checks. What it does OpenExec is an OpenClaw skill that packages a small Python service for governed execution. The skill describes a proposal-to-approval-to-execution boundary: agents submit structured requests, OpenExec checks mode rules, rejects nonce replay, emits deterministic receipts, and verifies signed approval artifacts in ClawShield mode. The public source says it uses a static handler registry, avoids eval or dynamic loading, and performs no outbound governance calls during execution unless a remote database is explicitly configured. Who should use it Use this as a candidate for teams building agents that can touch email, infrastructure, payments, internal tools, or other irreversible actions. It fits operators who want a separate execution layer with receipts instead of letting the model directly run every proposed tool action. It is not a replacement for policy review, prompt-injection defense, container isolation, or approval governance. Setup surface The Awesome OpenClaw Skills DevOps category lists openexec-skill as a source-distributed deterministic execution service with pinned dependencies. ClawHub lists audit pass signals and describes the service as having no runtime package installation or dynamic downloads. The source tree exposes SKILL.md, SECURITY.md, README.md, main.py, requirements, tests, scripts, and configuration folders. The skill uses Python and FastAPI-style service execution through uvicorn. Pricing evidence: SKILL.md states demo mode is free with no external governance required; ClawShield mode references a production or business governance SaaS. Treat the OpenExec skill candidate as free for demo-mode review, with the production governance layer priced separately or unclear from the fetched sources. Runner test plan Static scan: inspect SKILL.md, README.md, SECURITY.md, main.py, requirements, tests, scripts, config, and handler registry files. Dependency/install review: verify pinned Python requirements, no install hooks, no runtime downloads, and no hidden binary payloads before installing in a sandbox. Prompt-injection/tool-poisoning review: test whether untrusted proposal payloads can mutate action names, bypass nonce checks, override approval requirements, or poison receipt verification. Sandbox execution: run demo mode in an isolated test workspace on localhost only, with fixture handlers and fixture payloads. Then test ClawShield mode using test keys, not production approval keys. Screenshot/video when UI or command output exists: capture health endpoint output, execute response, replay response, receipt verification response, and server logs from the sandbox run. No browser UI is expected. Residual risks: verify handler privileges, localhost binding, remote database behavior, receipt collision assumptions, replay persistence across restart, action allow-list enforcement, and behavior when deployed behind a proxy. Risk notes This is not a tested recommendation yet. OpenExec is an execution boundary, not an OS sandbox. Handlers run with the privileges of the hosting process, so a bad handler or exposed service can still damage the host. The security document says operators must handle host isolation, firewalling, TLS, database trust, and action allow-listing. The fetched GitHub HTML confirms main.py and requirements exist in the source tree, but raw file fetching for some files returned 404 or rate-limit errors during this run; Runner review should fetch the repository directly in a clean environment before any execution. Source links Awesome OpenClaw Skills DevOps category: https://github.com/VoltAgent/awesome-openclaw-skills/blob/main/categories/devops-and-cloud.md Clawskills listing: https://clawskills.sh/skills/trendinghot-openexec-skill ClawHub page: https://clawhub.ai/trendinghot/openexec-skill Source tree: https://github.com/openclaw/skills/tree/main/skills/trendinghot/openexec-skill SKILL.md source page: https://github.com/openclaw/skills/blob/main/skills/trendinghot/openexec-skill/SKILL.md SECURITY.md source page: https://github.com/openclaw/skills/blob/main/skills/trendinghot/openexec-skill/SECURITY.md
Free
Review open
A practical self-hosting resource for exposing Docker apps inside a private Tailnet instead of opening router ports, reverse proxies, and public subdomains by default. What this is ScaleTail is a collection of ready-to-run Docker Compose stacks that attach common self-hosted apps to a Tailscale tailnet through a sidecar container. The useful idea is simple: make private tools reachable from your own devices without turning every dashboard, password vault, document archive, or admin panel into a public web service. Best use case Use this when you run services such as Vaultwarden, Paperless-ngx, Jellyfin, Immich, Pi-hole, AdGuard Home, Home Assistant, Open WebUI, Portainer, or Uptime Kuma and want remote access without a new router port, reverse-proxy rule, or public DNS entry for every app. Workflow Create a reusable Tailscale auth key in the Tailscale admin console. Pick the ScaleTail template matching your service. Review the Docker Compose file before running it, especially volumes, environment variables, and exposed ports. Bind the app container to the Tailscale sidecar network stack with the template's networkmode: service: pattern. Start the stack with Docker Compose and confirm the service appears in your Tailnet. Use Tailscale Serve for private Tailnet access. Only use Funnel when the service is intentionally public. Security notes ScaleTail reduces accidental public exposure, but it does not replace Docker hardening, backups, patching, or least-privilege access controls. Treat every template as code: inspect the image source, tags, volume mounts, environment variables, and update policy before production use. Keep admin panels, password managers, document stores, and local AI interfaces private unless you have a strong reason to expose them publicly. Do not confuse Tailscale Serve with Funnel: Serve is private to the Tailnet, while Funnel publishes a service to the public internet. Quick decision table Need Use ScaleTail? Caveat --- --- --- Private remote access to homelab apps Yes Requires Tailscale and Docker Compose Public webhook endpoint Maybe Funnel can be public; harden it carefully Full site publishing No Use a normal deployment and security model Multi-service homelab on one host Yes Still plan backups, updates, and separation Source check The Tarnkappe article explains the privacy angle, the Serve/Funnel distinction, and why ScaleTail fits self-hosted Docker services that should not be exposed publicly by default. The ScaleTail GitHub repository confirms that the project provides Docker Compose sidecar configurations for connecting self-hosted apps to a Tailnet. Tailscale's own Docker documentation provides the official baseline for running Tailscale with containers.
Free
Review open
A free OpenClaw community skill candidate for keeping Agent Skill bundles traceable with manifests, changelogs, SHA-256 hashes, and stale-file checks across chat, CLI, IDE, and registry workflows. What it does Skill Provenance is an author-side metaskill for Agent Skill bundles. It documents a portable MANIFEST.yaml, CHANGELOG.md, per-file version metadata, and SHA-256 hash checks so a skill's SKILL.md, evals, scripts, references, and packaged copies can be tracked across sessions and platforms. The upstream source describes it as free and open with an MIT license. Who should use it OpenClaw skill authors, maintainers, and teams who move skills between local folders, GitHub, ClawHub, Claude-style .skill packages, Codex/Gemini-compatible strict copies, or multiple agent sessions. It is most useful when bundle drift, stale evals, renamed files, or unclear handoffs are a recurring problem. Setup surface The published surface is a community OpenClaw skill on ClawHub with canonical source at the public GitHub repository. The bundle includes SKILL.md, README.md, MANIFEST.yaml, CHANGELOG.md, eval files, validate.sh, and package.sh according to the fetched manifest. Treat installation commands and scripts in the source as review material only until Runner AI Review finishes. Pricing evidence from the upstream GitHub README states it is free and open; license evidence points to MIT. Risk notes This is not yet claimed as tested, safe, clean, recommended, or production-ready by LinkLoot. The concept relies on local file inventory and hash checks, but the upstream source itself notes that a manifest is not a cryptographic signature or trust anchor. The included shell scripts should be reviewed as code and executed only in sandbox after static analysis. Because the skill is designed to edit manifests/changelogs and package derived copies, Runner should verify it does not mutate unrelated files, read broad home/config/SSH paths, or follow embedded source instructions beyond the user's explicit task. Source links Awesome OpenClaw Skills list: https://github.com/VoltAgent/awesome-openclaw-skills and category listing https://raw.githubusercontent.com/VoltAgent/awesome-openclaw-skills/main/categories/security-and-passwords.md ClawHub page: https://clawhub.ai/snapsynapse/skill-provenance Underlying GitHub/source repository: https://github.com/snapsynapse/skill-provenance Source SKILL.md: https://raw.githubusercontent.com/snapsynapse/skill-provenance/main/skill-provenance/SKILL.md Source manifest: https://raw.githubusercontent.com/snapsynapse/skill-provenance/main/skill-provenance/MANIFEST.yaml
Free
Review open
A practical defensive guide for checking your own codebase with AI agents: narrow scopes, parallel hunts, adversarial validation, reachability tracing, dedupe, gapfill, and governance gates. Built from the core operational lessons in Cloudflare's Project Glasswing write-up.
29
Review open
A community OpenClaw skill candidate that wraps GitGuardian ggshield so an agent can scan repositories, staged changes, files, and Docker images for leaked credentials before code is pushed. What it does The ggshield-scanner skill gives an OpenClaw-style agent a natural-language surface for GitGuardian's ggshield CLI. The source describes repository scans, single-file scans, staged-change checks, optional git hook installation, and Docker image scans for hardcoded secrets such as API keys, cloud credentials, private keys, OAuth tokens, and database passwords. Who should use it Developers, solo builders, and security-conscious agent operators who want an agent-assisted secret check before commits, pushes, releases, or Docker image handoff. It is especially useful for teams that already accept GitGuardian/ggshield in their workflow and want the agent to orchestrate checks rather than manually remembering every command. Setup surface The source indicates a Python-based skill that depends on ggshield and pygitguardian, requires a GitGuardian API key via GITGUARDIANAPIKEY, and calls the local ggshield binary. The public GitHub source is reachable, but the ClawHub/awesome-list OpenClaw tree link appears inconsistent with the reachable repository, so provenance should be reviewed carefully before any install. Pricing evidence in the source says GitGuardian signup is free, with enterprise/on-premise options mentioned separately; classify this Loot as free with that caveat. Risk notes Do not install or run directly on a production Raspberry Pi or personal workspace before Runner review artifacts exist. The implementation shown uses subprocess calls to ggshield with argument arrays rather than shell=True, which is a good sign, but it still executes a local binary and can scan sensitive paths if the agent is allowed to choose broad inputs. The hook installer changes git repository state. Review privacy claims against current GitGuardian documentation before scanning private code. Source links Awesome OpenClaw Skills list: https://github.com/VoltAgent/awesome-openclaw-skills Awesome category entry: https://raw.githubusercontent.com/VoltAgent/awesome-openclaw-skills/main/categories/security-and-passwords.md ClawHub page: https://clawhub.ai/amascia-gg/ggshield-scanner Reachable source repository: https://github.com/GitGuardian/ggshield-skill Source SKILL.md: https://raw.githubusercontent.com/GitGuardian/ggshield-skill/main/SKILL.md
Free
Review open
Blog
Related reads
Tools & Apps
Oracle ships record July CPU with 1,449 security patches
Oracle's July 2026 Critical Patch Update is its largest security release to date, covering 1,449 patches across 334 products and giving Orac…
Tools & Apps
Suno breach exposes 55M accounts as HIBP confirms dataset
Have I Been Pwned has added Suno's November 2025 breach, listing more than 55 million unique email addresses plus phone numbers and a smalle…
Tools & Apps
Vercel WAF now protects Blob stores in beta
Vercel has extended its Web Application Firewall to Vercel Blob stores in beta, letting teams apply deny, challenge, and rate-limit rules to…
Tools & Apps
PAN-OS GlobalProtect flaw now leads to Qilin ransomware intrusions
Arctic Wolf says CVE-2026-0257 has moved from observed GlobalProtect exploitation to Qilin ransomware intrusions, giving PAN-OS administrato…
Tools & Apps
Anthropic brings Claude Security scans to Claude Code beta
Anthropic's Claude Security plugin is now documented for Claude Code, adding multi-agent repository scans, diff scans, and reviewed patch fi…
Tools & Apps
Next.js patches July security flaws across App Router and Server Actions
Next.js released v16.2.11 and v15.5.21 to fix July 2026 security issues across App Router, Server Actions, middleware/proxy behavior, SSRF p…
Tools & Apps
Node.js schedules HIGH-severity security releases for July 27
The Node.js project says security releases for the 26.x, 24.x, and 22.x lines are due on or shortly after July 27, 2026, with the highest se…
Tools & Apps
CISA puts WordPress wp2shell RCE in KEV with July 24 deadline
CISA now lists two WordPress Core wp2shell vulnerabilities as actively exploited, with a July 24 deadline for CVE-2026-63030 and an August 4…
Tools & Apps
GitHub puts Copilot code review behind a default firewall
GitHub now gives Copilot code review its own firewall, setup workflow, and runner configuration, separating review-agent controls from the b…
Tools & Apps
Fortinet FortiSandbox CVEs enter CISA KEV with July 19 deadline
CISA added two Fortinet FortiSandbox command-injection flaws to KEV on July 16, with a July 19 remediation deadline for covered agencies and…
AI & Automation
Claude Code 2.1.214 fixes permission bypasses in agent shell checks
Anthropic's July 18 Claude Code update closes several permission-check gaps around Windows PowerShell 5.1, Bash parsing, long shell commands…
Tools & Apps
Cloudflare ships emergency WAF rules for active RCE and SQLi attacks
Cloudflare's July 17 emergency WAF release adds block-mode detections for active unauthenticated RCE and SQL injection exploitation in popul…
Tools & Apps
WordPress 7.0.2 forces security updates for wp2shell RCE
WordPress 7.0.2 fixes one critical and one high-severity core issue, with forced automatic updates enabled for affected branches and Cloudfl…
Tools & Apps
SharePoint CVE-2026-58644 is exploited; admins face a July 19 deadline
CISA and NVD now mark CVE-2026-58644 as actively exploited against Microsoft SharePoint Server, with emergency remediation pressure on expos…
Tools & Apps
GitHub expands secret scanning with Resend tokens and monitoring insights
GitHub is rolling out secret scanning updates that add Resend and APIclub detectors, block VolcEngine Ark API keys by default, expose secret…
Tools & Apps
Patch Oracle E-Business Suite Payments Before the New KEV Deadline
CISA added CVE-2026-46817 to the KEV catalog with a July 18 deadline after evidence of active exploitation. Oracle E-Business Suite teams sh…
Tools & Apps
Patch AD FS CVE-2026-56155 Before a Foothold Becomes Admin Access
Microsoft and CISA list CVE-2026-56155 as an actively exploited AD FS elevation-of-privilege flaw. Patch exposed Windows Server estates firs…
Tools & Apps
Patch SharePoint CVE-2026-56164 Before a Low CVSS Score Hides the KEV Risk
Microsoft's July 2026 Patch Tuesday includes an actively exploited SharePoint Server privilege escalation flaw that NVD lists in CISA KEV, d…
Tools & Apps
Patch SonicWall SMA 1000 Now, Then Check for Compromise
SonicWall says two SMA 1000 vulnerabilities are actively exploited, and CISA has added the issues to KEV. Patch affected appliances, then re…
Tools & Apps
Patch SharePoint CVE-2026-56164 before the new CISA deadline
CISA says CVE-2026-56164 is being actively exploited against on-premises SharePoint Server. Treat the July 2026 Patch Tuesday fix as an emer…
Tools & Apps
Cloudflare Precursor Makes Bot Detection a Full-Session Problem
Cloudflare has launched Precursor, a session-based bot detection system that watches browser behavior across a full visit instead of relying…
Tools & Apps
Find Old Cisco IOS Routers Before CVE-2008-4128 Becomes a Pivot
CISA added CVE-2008-4128 to KEV on July 13, 2026. The flaw affects obsolete Cisco IOS 12.4 systems, so the practical task is inventory, isol…
Tools & Apps
Patch Joomla Form Extensions Now: CISA Adds Balbooa Forms and iCagenda RCEs to KEV
CISA added two actively exploited Joomla extension upload flaws to KEV on July 10, 2026, with a July 13 remediation deadline for covered age…
Tools & Apps
Mark Vercel secrets as Sensitive before build logs expose them
Vercel now redacts Sensitive Environment Variable values from build logs, but only when the variable is marked Sensitive and the value is 32…
Tools & Apps
CISA KEV puts Adobe, Joomla and Langflow flaws on an urgent patch list
CISA's KEV catalog lists exploited Adobe ColdFusion, Joomla page-builder and Langflow vulnerabilities with near-term remediation deadlines, …
Tools & Apps
Harden Cloudflare IPsec Tunnels Before Quantum Downgrade Risk Reaches Production
Cloudflare added beta IKEv2 full-transcript authentication for WAN and Magic Transit IPsec tunnels, closing a downgrade gap that can survive…
Business & Karriere
Verify Shopify Partner IDs Before Collaborator Requests Start Failing
Shopify has started identity verification for Partners who send new collaborator requests, with mandatory enforcement coming in the next few…
Tools & Apps
Patch Langflow now: CISA flags CVE-2026-55255 as actively exploited
CISA added Langflow CVE-2026-55255 to the Known Exploited Vulnerabilities catalog, giving federal agencies until July 10, 2026 to mitigate a…
Tools & Apps
CISA adds Adobe ColdFusion CVE-2026-48282 to KEV with a July 10 patch deadline
CISA has marked Adobe ColdFusion CVE-2026-48282 as actively exploited, giving U.S. federal civilian agencies until July 10, 2026, to apply v…
Tools & Apps
Patch these three CISA KEV entries before public exposure turns expensive
CISA added three actively exploited vulnerabilities to the KEV catalog on July 7, covering Joomlack Page Builder, Langflow, and Adobe ColdFu…
Tools & Apps
Check Cloudflare WAF Logs Before Citrix and Kemp Exploit Traffic Turns Noisy
Cloudflare has scheduled new WAF detections for Citrix NetScaler CVE-2026-8451 and Progress Kemp LoadMaster CVE-2026-8037, giving defenders …
Wissen & Lernen
Patch UniFi OS before the RCE chain becomes your network foothold
Ubiquiti's UniFi OS command-injection flaw is now listed as actively exploited, and Bishop Fox shows how it can sit inside an unauthenticate…
Wissen & Lernen
Patch Cisco SD-WAN Manager before CVE-2026-20262 turns into root access
Cisco says CVE-2026-20262 lets an authenticated attacker create or overwrite files on Catalyst SD-WAN Manager systems and may later be used …