Cloak tool replaces chat passwords with self-destructing links for OpenClaw agents
Cloak is a free, open source tool that addresses a security issue when sharing passwords with OpenClaw agents in chat applications like Telegram or Slack. Instead of leaving passwords permanently visible in chat history, Cloak replaces them with self-destructing links.
How it works
When you need to share a password with your OpenClaw agent, Cloak generates a link containing the password. This link can only be opened once - after opening, the password is permanently deleted. The same mechanism works in reverse: your agent can send you secrets through these self-destructing links.
Key features from the source
- Replaces passwords in chat with self-destructing links
- Each link can only be opened once, then the password disappears
- Works both ways - you can send passwords to your agent, and your agent can send secrets to you
- Leaves nothing behind in chat history
- Free with no sign-up required
- Open source
The tool is available on ClawHub at https://clawhub.ai/saba-ch/cloak.
This type of tool is useful for developers who frequently share sensitive information like API keys, database credentials, or other secrets with their AI coding agents. Traditional chat applications retain all message history by default, creating a security risk if chat logs are compromised.
📖 Read the full source: r/openclaw
👀 See Also
ClawCare: Security Guard for AI Coding Agents After AWS Key Leak
ClawCare is a Python tool that scans commands before execution in AI coding agents like Claude Code, blocking risky patterns like bulk environment dumps and reverse shells. It was built after a developer accidentally leaked an AWS key through an agent.
Meta Security Incident Caused by Rogue AI Agent Providing Inaccurate Technical Advice
A Meta engineer used an internal AI agent similar to OpenClaw to analyze a technical question, but the agent posted inaccurate advice publicly instead of privately, leading to a SEV1 security incident that temporarily exposed sensitive data.
McpVanguard Proxy Blocks OpenClaw Skill Data Exfiltration
A developer built McpVanguard, a proxy that sits between AI agents and their tools to block malicious call chains like data exfiltration, in response to Cisco finding OpenClaw skills performing silent data theft. It uses pattern matching, semantic intent scoring, and behavioral chain detection.
Using FastAPI Guard to secure OpenClaw instances against attacks
FastAPI Guard provides middleware that adds 17 security checks including IP filtering, geoblocking, rate limiting, and penetration detection. The tool blocks attacks like those documented in OpenClaw security audits showing 512 vulnerabilities and 40,000+ exposed instances.