openclaw-ref — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited openclaw-ref (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Structured reference for the OpenClaw assistant platform. Source repo: ~/Projects/openclaw/. Tracking version: 2026.4.7 (refresh: 2026-04-07).
Load the relevant reference file based on the task:
OpenClawConfig), config paths, file format (JSON5), env var substitution, $include directives, validation (Zod), per-plugin config, programmatic read/write. Read when modifying or generating openclaw config.models.mode (merge/replace), x402 providers, model catalog structure, provider registration via plugins. Read when configuring model access or building provider plugins./refresh-openclaw. Read before starting any non-trivial openclaw work to avoid known pitfalls.src/plugins/ - Plugin loader, discovery, registry, install, types
src/plugin-sdk/ - 100+ scoped exports for plugin consumption
src/config/ - Config loading, types, validation, defaults, paths
src/gateway/ - Gateway server, boot, startup, server methods
src/commands/ - CLI commands (onboard, config, etc.)
src/cli/ - CLI wiring (plugins-cli, skills-cli, etc.)
extensions/ - Extension implementations (channels, memory, etc.)
skills/ - Built-in skill definitions
docs/ - Documentation (Mintlify)~/.openclaw/openclaw.json (parsed as JSON5)~/.openclaw/extensions/~/.openclaw/skills/ (managed) + workspace skills~/.openclaw/agents/<agent-id>/~/.openclaw/agents/<agent-id>/sessions/~/.openclaw/credentials/OPENCLAW_CONFIG_PATH env var{
"id": "plugin-id",
"name": "Display Name",
"kind": "memory",
"channels": ["channel-id"],
"providers": ["provider-id"],
"configSchema": { "type": "object" },
"uiHints": { "field": { "label": "...", "sensitive": true } }
}Top-level keys in OpenClawConfig: meta, auth, acp, env, secrets, plugins, skills, models, agents, tools, channels, session, hooks, gateway, logging, browser, memory, messages, approvals, cron
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.