The openclaw security audit your built-in one doesn’t run.
trentclaw runs a continuous security audit on your 🦞OpenClaw config, skills, and tool permissions. You get prioritized findings and the exact fix for each one.
We analyzed all 52,652 ClawHub skills – in a behavioral scan of the top 2,354, 86% shipped with vulnerabilities and 4.4% were malicious. 🏆 The Hacker News 2026 Winner
Built for your OpenClaw agents
Users deploying autonomous agents
If you’re running agents on OpenClaw, handling tasks, calling tools, or operating across systems, the assessment shows you the security risks in your runtime configuration that you can’t see during normal operation. Running agents across a team? See how continuous OpenClaw monitoring works at scale.
Users building and publishing skills
If you’re developing OpenClaw skills, the assessment checks that your skills request only the permissions they need and don’t introduce credential exposure or unvalidated tool calls.
Up and running in 3 steps
Step 1: Get your API key, it is free
Generate a Trent API key to authenticate the security assessment. You’ll see it immediately after login, copy it right away.
Step 2: Install the skill
Install from ClawHub. Set your key in the OpenClaw UI.
openclaw skills install @trent-ai-release/trentclaw
Use --force to upgrade an existing install.
Set your key:
openclaw config set skills.entries.trent-openclaw-security.apiKey YOUR_TRENT_API_KEY
For advanced key setup see Source on GitHub ↗ · View on ClawHub ↗
Step 3: Run your first audit
Start a new agent session and ask it to audit your setup. Results appear grouped by severity with recommended fixes.
What you’ll get back:
- Findings grouped by severity (Critical / High / Medium / Low)
- Each finding mapped to the specific part of your setup that’s affected
- Chained attack paths where multiple settings combine to create worse outcomes
- Recommended config changes as diff snippets you can review and apply
> Audit my OpenClaw setup for security risks using trent
Full coverage. One audit.
Agentic AI Security Platform Leader
See what’s hiding in your 🦞OpenClaw setup
Get your API key and run your first security audit in minutes.
How does trentclaw compare to NVIDIA NemoClaw?
Nemo is sandboxing. We recommend it. There are lots of other attack vectors. For those we recommend Trent. Just like we use security tools on top of containerised apps today.
Is OpenClaw safe to run?
We assessed its CVE record, skill ecosystem and default configuration in our Is OpenClaw safe? article.
What are the biggest security risks in an OpenClaw deployment?
our layers: the architecture itself, the CVE record, the ClawHub supply chain, and gateway exposure. We break down all four in our map of OpenClaw security risks.
What is an OpenClaw security assessment?
A security assessment for OpenClaw is an automated audit of your agent environment. It analyzes your configuration and installed skills to identify risks like plaintext secrets, overpermissive access, and unsafe gateway exposure. Findings are grouped by severity (Critical, High, Medium, and Low) with recommended fixes you can apply directly in your OpenClaw host.
What does the security assessment check?
It audits your OpenClaw configuration, environment variables, and installed skills. It identifies secrets in plaintext, overly permissive access policies, unsafe gateway exposure, and tool permissions that give agents more power than intended. Each finding is mapped to the specific part of your setup that is affected.
How do I run the assessment?
Get an API key at trent.ai, install the skill with openclaw skills install @trent-ai-release/trentclaw, set your key in the OpenClaw UI, then start a new agent session and ask “Audit my OpenClaw setup for security risks using trent.” Results appear within minutes.
What happens if I lose my API key?
You can view, revoke, or rotate keys anytime at app.trent.ai. If you lose access, sign in and create a new one, then re-run setup with the new key.
Does this replace OpenClaw’s built-in openclaw security audit command?
VirusTotal scans public skills on ClawHub for known malware. The built-in openclaw security audit checks your local configuration. Neither covers your custom code and skills. Trent’s security assessment does all three: it scans your OpenClaw configuration, public skills you’ve installed, and your custom code and skills, giving you full coverage in one audit.
What is trentclaw?
trentclaw is Trent AI’s security assessment skill for the OpenClaw agent runtime. It runs directly inside OpenClaw and audits your configuration, environment variables, and installed skills for risks like plaintext secrets, overly permissive access policies, and unsafe gateway exposure. Findings appear inside OpenClaw, not in a separate dashboard or external console.
How is trentclaw different from OpenClaw itself?
OpenClaw is the agent runtime, a third-party platform for running autonomous agents. trentclaw is Trent AI’s security skill that runs inside OpenClaw. OpenClaw is the host; trentclaw is one of the skills installed in it. OpenClaw is not built or operated by Trent.
Do I need approval to use trentclaw?
No. trentclaw is self-serve. Create a Trent account, generate an API key, install the skill, and run your first audit. No approval queue.
Where do trentclaw findings appear?
Findings appear inside your OpenClaw environment, alongside the agent session that triggered the audit. There is no external Trent dashboard or separate console. The findings render where you already are, in OpenClaw.
Is trentclaw open source?
Yes. trentclaw is open source. The source repository is at github.com/trnt-ai/trent-openclaw-security-assessment. It is distributed through ClawHub at clawhub.ai/trent-ai-release/trentclaw
How does Trent integrate with OpenClaw?
The Trent integration runs continuously inside your OpenClaw environment. It observes configuration changes, installed skills, and tool permissions across every agent you run, then surfaces risks. No code changes to your agents. No new infrastructure to deploy. The integration uses the same Scan, Judge, and Mitigate agents that power Trent’s broader platform.