Practical security insights and product updates from the team building safer, simpler key management for modern APIs.
A ClawHub skill runs with the same permissions as your OpenClaw agent, no sandbox, no isolation. Here's what you should check before installing any third-party skill.
CNCERT flagged prompt injection in AI agents as a national security risk. The Telegram link preview exfiltration technique is real. Here's how a credential proxy makes it structurally impossible.
Run API Stronghold as a credential proxy for OpenClaw so agents never hold real API keys. Fake keys in, real credentials injected at the proxy, nothing reaches the LLM context window.
Security researchers found 21,000 exposed OpenClaw instances in two weeks. Here's why agent tokens leak and how scoped secrets contain the damage.
135,000 exposed OpenClaw instances, 824+ malicious skills, and a CVSS 8.8 RCE in 2026. Here's what went wrong and how to stop your API keys from being the next casualty.
7% of OpenClaw skills expose API keys through the LLM context window. Isolate your credentials with scoped secrets so keys never touch the model.