Cloak tool replaces chat passwords with self-destructing links for OpenClaw agents

Cloak is a free, open source tool that addresses a security issue when sharing passwords with OpenClaw agents in chat applications like Telegram or Slack. Instead of leaving passwords permanently visible in chat history, Cloak replaces them with self-destructing links.
How it works
When you need to share a password with your OpenClaw agent, Cloak generates a link containing the password. This link can only be opened once - after opening, the password is permanently deleted. The same mechanism works in reverse: your agent can send you secrets through these self-destructing links.
Key features from the source
- Replaces passwords in chat with self-destructing links
- Each link can only be opened once, then the password disappears
- Works both ways - you can send passwords to your agent, and your agent can send secrets to you
- Leaves nothing behind in chat history
- Free with no sign-up required
- Open source
The tool is available on ClawHub at https://clawhub.ai/saba-ch/cloak.
This type of tool is useful for developers who frequently share sensitive information like API keys, database credentials, or other secrets with their AI coding agents. Traditional chat applications retain all message history by default, creating a security risk if chat logs are compromised.
📖 Read the full source: r/openclaw
👀 See Also

Student contributes two security patches to OpenClaw production system
A student developer fixed a 'fail-open' vulnerability in OpenClaw's gateway logic (PR #29198) and a tabnabbing vulnerability in chat images (PR #18685), with both patches landing in production releases v2026.3.1 and v2026.2.24 respectively.

AgentSeal Security Scan Finds AI Agent Risks in Blender MCP Server
AgentSeal scanned the Blender MCP server (17k stars) and identified several security issues relevant to AI agents, including arbitrary Python execution, potential file exfiltration chains, and prompt injection patterns in tool descriptions.

OpenClaw Skill Analyzer: Static Security Scanner for AI Agent Skills
A developer built a static analyzer that scans OpenClaw skills for security risks before installation, with 40+ detection rules across 12 categories including prompt injection and data exfiltration.

Security Alert for Local OpenClaw Instances Without Sandboxing
A Reddit post warns that running vanilla OpenClaw instances locally without proper isolation can lead to exposed API keys, accidental file deletion, and data leaks. The source recommends sandboxing bash tools or using a managed service.