clawsec-net

Scan ClawSec backend and OpenClaw gateway for network exposure risks.

Updated Mar 9, 2026

Search Tags:#network security #vulnerability scanning #openclaw #clawsec #port binding #gateway exposure

Ready to run

npx skills add https://github.com/4e696b6f/clawsec-agent --skill clawsec-net

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: clawsec-net
Source: https://github.com/4e696b6f/clawsec-agent/tree/main/skills/clawsec-net
Command: npx skills add https://github.com/4e696b6f/clawsec-agent --skill clawsec-net

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill identifies potential network exposure risks associated with the ClawSec backend server and OpenClaw gateway configuration, ensuring sensitive services are not inadvertently made accessible.

Core Features & Use Cases

Port Binding Check: Verifies if the ClawSec backend server (port 3001) is listening on accessible network interfaces.
Gateway Exposure Check: Inspects the OpenClaw configuration to ensure the gateway is bound to a loopback address.
Use Case: Before deploying ClawSec, use this skill to confirm that the backend server is only accessible from localhost, preventing unauthorized external access.

Quick Start

Run the clawsec-net skill to check for network exposure issues.

Frequently Asked Questions about clawsec-net

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I check if my backend server is listening on non-loopback interfaces?▼

To check if your backend server is listening on non-loopback interfaces, scan for port binding risks using the clawsec-net skill. It requires ss or netstat to verify that port 3001 is not exposed to external networks.

What is gateway exposure in OpenClaw configuration?▼

Gateway exposure in OpenClaw configuration occurs when the gateway bind address is not set to localhost. The clawsec-net skill inspects openclaw.json to identify if the gateway is inadvertently bound to accessible network interfaces.

How to scan for network exposure risks before deploying ClawSec?▼

Scan for network exposure risks before deploying ClawSec by running the clawsec-net skill. It checks port 3001 binding and OpenClaw gateway configuration to ensure sensitive services are only accessible from localhost.

Does clawsec-net require ss or netstat to perform a port binding check?▼

Yes, clawsec-net requires ss or netstat to perform a port binding check. The skill relies on these system utilities to detect services listening on accessible network interfaces instead of loopback addresses.

Can I use clawsec-net to verify my OpenClaw gateway is bound to a loopback address?▼

Yes, you can use clawsec-net to verify your OpenClaw gateway is bound to a loopback address. The skill requires direct file access to openclaw.json to analyze the gateway bind configuration and prevent unauthorized external access.

What are the limitations of scanning network exposure with clawsec-net?▼

Limitations of scanning network exposure with clawsec-net include its dependency on ss or netstat for port checks and requiring direct file access to openclaw.json. It cannot scan configurations without these system utilities or file permissions.