A CLI tool that audits OpenClaw plugin dependency trees, flags transitive security risks, and recommends a minimal install profile based on actual usage
OpenClaw v2026.5.12 externalized WhatsApp, Slack, Bedrock, Vertex, and OpenShell into optional plugins. Fresh installs are smaller, but admins now manage their own plugin stacks with no visibility into what each plugin pulls in transitively. The npm supply chain attacks that triggered the rough week came through transitive packages and postinstall scripts. This tool scans the dependency tree of every installed OpenClaw plugin, flags known CVEs and suspicious install-time behavior in transitive deps, and recommends which plugins to remove based on actual usage telemetry from the gateway logs.
Demand Breakdown
Social Proof 3 sources
Gap Assessment
3 tools exist (ClawSecure, SecureClaw, OpenClaw built-in security audit) but gaps remain: Does not analyze per-plugin transitive dependency trees, no usage telemetry correlation, no minimal-install recommendations, no lockfile for CI drift detection; Broad security posture checks, not focused on plugin dependency tree depth or transitive risk scoring. No usage-based pruning recommendations..
Features4 agent-ready prompts
Competitive LandscapeFREE
| Product | Does | Missing |
|---|---|---|
| ClawSecure | 3-layer security audit scanning 55+ OpenClaw threat patterns, behavioral code analysis, and supply chain checks across npm and PyPI | Does not analyze per-plugin transitive dependency trees, no usage telemetry correlation, no minimal-install recommendations, no lockfile for CI drift detection |
| SecureClaw | 55 audit checks evaluating OpenClaw installations for security conditions plus hardening modules to apply fixes | Broad security posture checks, not focused on plugin dependency tree depth or transitive risk scoring. No usage-based pruning recommendations. |
| OpenClaw built-in security audit | Built-in security audit command with --deep, --fix, and --json options for basic vulnerability scanning | Checks known vulnerabilities but not transitive dependency chains, no supply chain risk scoring, no usage telemetry analysis, no plugin lockfile |
Sign in to unlock full access.