Cloak tool replaces chat passwords with self-destructing links for OpenClaw agents
Cloak is a free, open source tool that addresses a security issue when sharing passwords with OpenClaw agents in chat applications like Telegram or Slack. Instead of leaving passwords permanently visible in chat history, Cloak replaces them with self-destructing links.
How it works
When you need to share a password with your OpenClaw agent, Cloak generates a link containing the password. This link can only be opened once - after opening, the password is permanently deleted. The same mechanism works in reverse: your agent can send you secrets through these self-destructing links.
Key features from the source
- Replaces passwords in chat with self-destructing links
- Each link can only be opened once, then the password disappears
- Works both ways - you can send passwords to your agent, and your agent can send secrets to you
- Leaves nothing behind in chat history
- Free with no sign-up required
- Open source
The tool is available on ClawHub at https://clawhub.ai/saba-ch/cloak.
This type of tool is useful for developers who frequently share sensitive information like API keys, database credentials, or other secrets with their AI coding agents. Traditional chat applications retain all message history by default, creating a security risk if chat logs are compromised.
📖 Read the full source: r/openclaw
👀 See Also
AI Agent Guardrails Decay Over Time Without Active Maintenance
AI agent guardrails degrade over time as system prompts accumulate updates, model versions change, and new tools are added, often resulting in contradictory or ignored safety rules that require regular review and testing.
OpenClaw's External Content Wrapper for Prompt Injection Defense
OpenClaw uses an external content wrapper that automatically tags web search results, API responses, and similar content with warnings that it's untrusted, priming the LLM to be skeptical and more likely to refuse malicious instructions.
Trojan found in Claude Flow repository skill.md files
A GitHub repository containing Claude Flow skill files was found to contain a Trojan identified as JS/CrypoStealz.AE!MTB. The malware triggered automatically when an AI-based IDE opened the folder to read the markdown files.
Security Checklist for Claude AI-Generated Applications
A developer shares a checklist of common security and operational gaps found in applications built with Claude Code, including rate limiting, authentication flaws, database scaling issues, and input handling vulnerabilities.