canaryScans your OpenClaw environment for leaked secrets — API keys, tokens, credentials in .env files, installed skills, and shell history. Runs silently on startup, deep scans on demand. Fixes issues with your permission.
Install via ClawdBot CLI:
clawdbot install sukiraman/canaryGrade Fair — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Accesses sensitive credential files or environment variables
~/.aws/credentialsSends data to undocumented external endpoint (potential exfiltration)
Webhook → https://hooks.slack.com/`Hardcoded API key or token pattern found in skill definition
AKIAIOSFODNN...Calls external URL not in known-safe list
https://hooks.slack.com/`Generated Mar 1, 2026
A tech startup uses Canary to automatically scan their development environment for leaked API keys and credentials in .env files and git repositories during daily operations. This helps prevent accidental exposure of sensitive data in public code commits and ensures compliance with security best practices from the outset.
A freelance developer runs Canary's deep scan before delivering a project to a client, checking for hardcoded secrets in skill directories and shell history. This ensures the client's environment is secure and reduces the risk of credential leaks post-handover, building trust and professionalism.
An enterprise DevOps team integrates Canary into their CI/CD pipeline to perform light scans on startup and deep scans on demand, auditing SSH keys, Kubernetes configs, and Terraform state files. This enforces security policies and mitigates risks from misconfigured permissions in cloud infrastructure.
An instructor uses Canary in a cybersecurity workshop to demonstrate real-time detection of leaked secrets in student environments, such as API keys in .env files or weak SSH permissions. The auto-fix feature with backups provides hands-on learning without risking data loss.
A small business owner runs Canary to scan their OpenClaw setup for exposed credentials in config files and browser password exports, ensuring customer data privacy. The tool's plain-language alerts and guided fixes help non-technical users maintain security without expert knowledge.
Offer Canary as a free basic tool with light scans and limited auto-fixes, while charging for advanced features like scheduled deep scans, compliance reporting, and integration with enterprise security systems. Revenue comes from subscription tiers tailored to individual users and businesses.
License Canary to large organizations as part of their security suite, providing custom integrations, dedicated support, and enhanced scanning for proprietary systems. Revenue is generated through annual licensing fees based on the number of users or endpoints covered.
Provide consulting services to help clients implement and customize Canary for specific environments, such as auditing legacy systems or developing plugins for unique use cases. Revenue comes from project-based fees and ongoing maintenance contracts.
💬 Integration Tip
Integrate Canary into your startup routine by enabling light scans on OpenClaw launch and scheduling periodic deep scans to catch new leaks early.
Scored Apr 19, 2026
Uses known external API (expected, informational)
slack.comAI Analysis
The skill definition contains a hardcoded AWS API key pattern (AKIAIOSFODNN...), indicating potential credential harvesting. It also references sending data to an undocumented external Slack webhook, which is a data exfiltration risk inconsistent with the skill's stated local auditing purpose.
Audited Apr 17, 2026 · audit v1.0
Generate study materials. Use when creating study plans, quizzes, flashcards, tracking progress, or scheduling review sessions.
Forces persistent problem solving using a Striver mindset and structured breakthrough methodology. MUST trigger when - (1) a task fails multiple times or pro...
Use for Hong Kong school admissions, school selection, secondary school, primary school, kindergarten, international school, and postsecondary advisory workf...
Loads any thinker's, leader's, philosopher's, or organization's complete mental operating system directly into the AI — so the AI reasons FROM inside that co...
SZZZ Case Study Lite 基础版。用于对用户已有的本地 PDF、DOCX、DOC 民事裁判文书执行批量提取、案号去重、增量入库、逐案专家摘要、Master Report、案例库问答和原文回溯。用户要求分析判决书、整理本地案例库、追加新案例或向已提取材料提问时使用;不包含外部案例检索和 Obsidi...
Configures Rocq environments, runs preflight checks, and guides the proving workflow for OpenMath Rocq theorems. Use when the user wants to set up Rocq tooli...