Cloak tool replaces chat passwords with self-destructing links for OpenClaw agents
Cloak is a free, open source tool that addresses a security issue when sharing passwords with OpenClaw agents in chat applications like Telegram or Slack. Instead of leaving passwords permanently visible in chat history, Cloak replaces them with self-destructing links.
How it works
When you need to share a password with your OpenClaw agent, Cloak generates a link containing the password. This link can only be opened once - after opening, the password is permanently deleted. The same mechanism works in reverse: your agent can send you secrets through these self-destructing links.
Key features from the source
- Replaces passwords in chat with self-destructing links
- Each link can only be opened once, then the password disappears
- Works both ways - you can send passwords to your agent, and your agent can send secrets to you
- Leaves nothing behind in chat history
- Free with no sign-up required
- Open source
The tool is available on ClawHub at https://clawhub.ai/saba-ch/cloak.
This type of tool is useful for developers who frequently share sensitive information like API keys, database credentials, or other secrets with their AI coding agents. Traditional chat applications retain all message history by default, creating a security risk if chat logs are compromised.
📖 Read the full source: r/openclaw
👀 See Also
Security Audit Finds Anthropic's MCP Reference Servers Vulnerable, Introduces Hallucination-Based Vulnerabilities
A security audit of 100 MCP server packages found 71% scored an F, including Anthropic's official GitHub and filesystem reference implementations. The audit identified Hallucination-Based Vulnerabilities that create security holes and waste tokens through reasoning loops.
Caelguard: Open-source security scanner for OpenClaw skills
Caelguard is an MIT-licensed, locally-run scanner that detects security issues in OpenClaw skills, including prompt injection, credential harvesting, and obfuscated payloads. Research shows approximately 20% of published skills contain concerning patterns.
Claude Android App Reportedly Reads Clipboard Without Explicit User Action
A user reports that the Claude Android app analyzed code from their clipboard without them pasting it, with Claude identifying the file as pasted_text_b4a56202-3d12-43c8-aa31-a39367a9a354.txt. The behavior couldn't be reproduced in subsequent tests.
Windows Notepad App Remote Code Execution Vulnerability CVE-2026-20841
CVE-2026-20841 is a remote code execution vulnerability in the Windows Notepad app. Details and mitigation steps are available in the Microsoft Security Response Center update guide.