Security monitoring for OpenClaw AI agent installations. Watches skills and config so you know when something's been tampered with.
ClawCop runs as a dedicated system user called mallcop. It has read-only access to
OpenClaw's skill directory, configuration files, and gateway settings. It cannot modify anything
OpenClaw manages, and OpenClaw cannot modify anything mallcop manages. The two users do not share
file permissions.
Findings are written to a separate directory owned by mallcop and pushed to a
private GitHub repo you control. If OpenClaw were compromised, it could not tamper with or
suppress mallcop's findings.
Reads OpenClaw's skill directory and config. Writes to its own findings directory. No shell. No sudo.
Runs the AI agent. Cannot read mallcop's findings directory. No access to mallcop config or credentials.
Standard Unix file permissions. No special framework required. Audit with ls -la.
Two things: skills and config. Everything else is out of scope.
On every patrol, ClawCop runs three checks in order.
Each skill has a manifest.yaml that declares its permissions
and the hash of its code files. ClawCop recomputes the hash and compares.
A mismatch is a finding.
ClawCop checks the permissions the skill is actually using against the permissions declared in its manifest. A skill exercising permissions it did not declare is a finding regardless of whether the code changed.
Compares the current gateway configuration against the last verified snapshot.
Any change triggers a finding. You acknowledge expected changes with
mallcop ack, which updates the snapshot.
mallcop