Skip to content

openclaw.md

Latest commit

 

History

History
49 lines (31 loc) · 2.12 KB

openclaw.md

File metadata and controls

49 lines (31 loc) · 2.12 KB
Raw
title OpenClaw integration
description Gate every OpenClaw before_tool_call event through Sponsio's contract engine, with bundled ClawHavoc + CVE-2026-25253 coverage.

OpenClaw integration

Sponsio plugs into the OpenClaw runtime as a host-level gate. Every before_tool_call event is checked against your active contracts before the tool fires, and every decision is streamed to your terminal.

Install

Use the standard Python onboarding path. Paste the Python one-shot prompt into Claude Code / Codex / Cursor, and when the wizard asks about IDE hosts, pick openclaw=full. The wizard installs the sponsio:incident/openclaw bundle and wires up the host gate.

Or run the CLI yourself:

pip install sponsio
sponsio init .
# When prompted for IDE hosts, choose openclaw=full

What you get

The bundled sponsio:incident/openclaw pack covers:

  • CVE-2026-25253: WebSocket 1-click remote code execution.
  • ClawHavoc: 1,184 malicious skills on ClawHub (Koi Security disclosure, Feb 2026).
  • The --yolo flag.
  • The weather-skill .env exfiltration pattern (Trend Micro write-up).

45 mixed det/sto rules in total. See docs/reference/contract-lib.md for the full rule list.

Watch live blocks

Every Sponsio decision against your OpenClaw runtime streams here:

sponsio host trace openclaw --follow

Output format and filtering options: docs/reference/observability.md.

Fork the pack

The OpenClaw bundle is also a worked example to fork from when authoring your own incident packs. Source: sponsio/contracts/incident/openclaw.yaml.

← Back to README · Other integrations