🛡️ TrustMyAgent

Security bodyguard for OpenClaw agents

Website • Trust Center • Quick Start • Contributing

An EDR-like security agent for OpenClaw agents. Runs 41 security checks across 14 domains, calculates a trust score (0-100), and sends telemetry to a centralized Trust Center dashboard where humans and other agents can verify trustworthiness.

Stateless by design - runs entirely in memory, stores nothing locally, leaves no traces on the host.

Why

AI agents are powerful but opaque. When an agent runs on a machine, how do you know it isn't:

• Leaking secrets from environment variables?
• Spawning suspicious processes?
• Accessing files it shouldn't?
• Running with excessive privileges?
• Connecting to exfiltration services?

TrustMyAgent answers these questions every 15 minutes and publishes the results to a public Trust Center so anyone can verify an agent's security posture.

Quick Start

As an OpenClaw Skill (recommended)

Copy into your workspace skills directory:

# From your OpenClaw workspace
mkdir -p skills/trustmyagent
cp -r /path/to/trust-my-agent-ai/* skills/trustmyagent/

After installation, ask the agent to run the setup:

"Set up TrustMyAgent"

The agent will follow the Setup instructions in SKILL.md to install dependencies, run a test assessment, and create the cron job (*/15 * * * *) in the agent:security:main session stream. See SKILL.md for the full setup steps.

Standalone

# Run assessment and send telemetry (agent name from IDENTITY.md)
python3 run.py

Requirements

• Python 3.8+
• openssl (for TLS checks)
• No pip dependencies - stdlib only

Security Domains

Trust Scoring

• Any critical failure caps the score at 49 (UNTRUSTED)
• 3+ high severity failures cap the score at 69 (LOW)

Check Types

Bash checks (20) - Shell commands that inspect the host environment. Defined in checks/openclaw_checks.json.

Python/Message sensors (10) - Programmatic checks that analyze secrets, session transcripts, MCP configs, skill manifests, Moltbook posts, and owner reputation. Defined in checks/message_checks.json.

OpenClaw infrastructure checks (11) - Python checks for node execution, media handling, gateway, identity, and subagent security. Defined in checks/nodes_media_checks.json.

All check types auto-detect macOS vs Linux and use platform-appropriate commands.

Architecture

┌─────────────────┐      POST /api/telemetry      ┌──────────────────┐
│   Agent Host     │  ─────────────────────────►   │ 🛡️ TrustMyAgent Server│
│                  │                                │  (Cloudflare)    │
│  run.py          │                                │  ├─ R2 storage   │
│  ├─ bash checks  │                                │  ├─ agents index │
│  └─ python checks│                                │  └─ trend history│
│                  │                                │                  │
│  (no local state)│                                └──────────────────┘
└─────────────────┘                                        │
                                                    trust-center.html
                                                    (public dashboard)

Configuration

The agent name is automatically read from your IDENTITY.md file (# Name section). Falls back to the OPENCLAW_AGENT_NAME env var, then "OpenClaw Agent".

Writing Custom Checks

Bash check

Add to checks/openclaw_checks.json:

{
  "check_id": "CUSTOM-001",
  "name": "My custom check",
  "description": "What this check verifies",
  "category": "integrity",
  "severity": "medium",
  "command": "echo 'SAFE'",
  "expected_output": "SAFE",
  "pass_condition": "contains"
}

Python check

Add the definition to checks/message_checks.json and the handler to run.py:

@python_check("CUSTOM-002")
def check_something(check: dict) -> Tuple[bool, str]:
    # Return (passed: bool, message: str)
    return True, "Everything looks good"

Contributing

See CONTRIBUTING.md for guidelines. We welcome:

• New security checks for emerging threat vectors
• Platform support improvements (Windows, ARM)
• Integration with additional agent frameworks
• Trust Center dashboard enhancements

License

MIT - built by Anecdotes AI for the OpenClaw ecosystem.