The openclaw security audit your built-in one doesn’t run.
trentclaw runs a continuous security audit on your 🦞OpenClaw config, skills, and tool permissions. You get prioritized findings and the exact fix for each one.
We scanned the top 2,354 ClawHub skills – 86% shipped with vulnerabilities,4.4% were malicious.
Built for your OpenClaw agents
Users deploying autonomous agents
If you’re running agents on OpenClaw, handling tasks, calling tools, or operating across systems, the assessment shows you the security risks in your runtime configuration that you can’t see during normal operation.
Users building and publishing skills
If you’re developing OpenClaw skills, the assessment checks that your skills request only the permissions they need and don’t introduce credential exposure or unvalidated tool calls.
Up and running in 3 steps
Step 1: Get your API key, it is free
Generate a Trent API key to authenticate the security assessment. You’ll see it immediately after login, copy it right away.
Step 2: Install the skill
Install from ClawHub. Set your key in the OpenClaw UI.
openclaw skills install trentclaw
Use --force to upgrade an existing install.
Set your key:
openclaw config set skills.entries.trent-openclaw-security.apiKey YOUR_TRENT_API_KEY
For advanced key setup see Source on GitHub ↗ · View on ClawHub ↗
Step 3: Run your first audit
Start a new agent session and ask it to audit your setup. Results appear grouped by severity with recommended fixes.
What you’ll get back:
- Findings grouped by severity (Critical / High / Medium / Low)
- Each finding mapped to the specific part of your setup that’s affected
- Chained attack paths where multiple settings combine to create worse outcomes
- Recommended config changes as diff snippets you can review and apply
> Audit my OpenClaw setup for security risks using trent
Full coverage. One audit.
Active In The Security Community & Proud Members
See what’s hiding in your 🦞OpenClaw setup
Get your API key and run your first security audit in minutes.
Is OpenClaw safe to run?
OpenClaw is powerful but carries real security risks if deployed without hardening. Common risks include secrets stored in plaintext in configuration files, overly permissive access policies, unsafe gateway exposure, and tool permissions that give agents far more power than intended. Running a security assessment on your environment identifies which of these risks are present in your specific setup and tells you exactly what to fix first.
How does trentclaw compare to NVIDIA NemoClaw?
Nemo is sandboxing. We recommend it. There are lots of other attack vectors. For those we recommend Trent. Just like we use security tools on top of containerised apps today.
What are the biggest security risks in an OpenClaw deployment?
The four most common risks are: (1) secrets stored in plaintext across configuration files and environment variables, (2) overly permissive access policies that give agents more filesystem and tool access than they need, (3) gateway configurations that expose agent endpoints beyond what’s intended, and (4) installed skills with tool permissions that give agents far more power than intended. Trent AI’s security assessment identifies each of these and maps them to the specific part of your setup that is affected.
What is an OpenClaw security assessment?
A security assessment for OpenClaw is an automated audit of your agent environment. It analyzes your configuration and installed skills to identify risks like plaintext secrets, overpermissive access, and unsafe gateway exposure. Findings are grouped by severity (Critical, High, Medium, and Low) with recommended fixes you can apply directly in your OpenClaw host.
What does the security assessment check?
It audits your OpenClaw configuration, environment variables, and installed skills. It identifies secrets in plaintext, overly permissive access policies, unsafe gateway exposure, and tool permissions that give agents more power than intended. Each finding is mapped to the specific part of your setup that is affected.
How do I run the assessment?
Get an API key at trent.ai, install the skill with “clawhub install trentclaw”, set your key in the OpenClaw UI, then start a new agent session and ask “Audit my OpenClaw setup for security risks using trent.” Results appear within minutes.
What happens if I lose my API key?
You can view, revoke, or rotate keys anytime at app.trent.ai. If you lose access, sign in and create a new one, then re-run setup with the new key.
Does this replace OpenClaw’s built-in openclaw security audit command?
VirusTotal scans public skills on ClawHub for known malware. The built-in openclaw security audit checks your local configuration. Neither covers your custom code and skills. Trent’s security assessment does all three: it scans your OpenClaw configuration, public skills you’ve installed, and your custom code and skills, giving you full coverage in one audit.
What is trentclaw?
trentclaw is Trent AI’s security assessment skill for the OpenClaw agent runtime. It runs directly inside OpenClaw and audits your configuration, environment variables, and installed skills for risks like plaintext secrets, overly permissive access policies, and unsafe gateway exposure. Findings appear inside OpenClaw, not in a separate dashboard or external console.
How is trentclaw different from OpenClaw itself?
OpenClaw is the agent runtime, a third-party platform for running autonomous agents. trentclaw is Trent AI’s security skill that runs inside OpenClaw. OpenClaw is the host; trentclaw is one of the skills installed in it. OpenClaw is not built or operated by Trent.
Do I need a waitlist to use trentclaw?
No. trentclaw is self-serve. Create a Trent account, generate an API key, install the skill, and run your first audit. No approval queue.
Where do trentclaw findings appear?
Findings appear inside your OpenClaw environment, alongside the agent session that triggered the audit. There is no external Trent dashboard or separate console. The findings render where you already are, in OpenClaw.
Is trentclaw open source?
Yes. trentclaw is open source. The source repository is at github.com/trnt-ai/trent-openclaw-security-assessment. It is distributed through ClawHub at clawhub.ai/trent-ai-release/trentclaw