- Category
- AI Agents
- Rank
- No. 1986Tools index
- Pricing
- Open Source
- Type
- AGENT
- Builder
- openclaw
- GitHub
- 40 stars
- Date
About
Clawd's evil twin — Flawd, the adversarial counterpart in the OpenClaw agent ecosystem.
What it does
This repository supplies GitHub automation that forwards issue, pull request, and selected comment events to ClawSweeper. It filters command-like comments, optionally reacts with eyes, posts a queued status for trusted contributors, and sends structured repository dispatch payloads. No standalone Flawd application or user documentation appears in the supplied text.
Why it's ranked here
The automation is careful and operationally specific, but the repository is extremely narrow. Scoped permissions, event filtering, concurrency control, and credential checks inspire confidence. Still, the available code looks like integration plumbing for another service, not a documented, independently usable bot.
What's good
The workflow avoids checking out untrusted pull request code and grants read-only content access by default. It mints narrowly scoped tokens for dispatch and target comments, ignores bot-driven label churn, debounces metadata bursts, cancels superseded runs, and fingerprints pull request state before forwarding it.
Tradeoffs
Useful behavior depends on a configured GitHub App private key and a separate ClawSweeper repository. Without credentials, dispatch is skipped. The supplied repository has no README, package manifest, local execution path, public API, or visible tests, so installation, expected responses, and failure recovery remain undocumented.
How to use it well
This fits maintainers who already operate ClawSweeper and need GitHub events routed into it with guarded permissions and basic command acknowledgement. Treat it as repository automation, then inspect and adapt its event rules. It does not replace a local bot, general-purpose agent library, hosted API, or documented end-user product.
Technical notes+
.github/workflows/clawsweeper-dispatch.yml listens to issue, issue_comment, and pull_request_target events on ubuntu-latest. It pre-filters mentions and slash commands, creates GitHub App tokens with scoped permissions, computes a SHA-256 ingress_fingerprint for pull requests, builds payloads with jq, and calls repository dispatch endpoints through gh api. Its pull_request_target job performs no checkout. LICENSE contains the CC0 1.0 Universal legal text.
Observed
- License
- CC0 1.0 Universal
- Primary surface
- GitHub Actions YAML with embedded shell, JavaScript, and jq
- Interface
- GitHub event automation and repository dispatch integration
- Runner platform
- GitHub-hosted Ubuntu runner
- Documentation
- No README is available in the supplied repository text
- Packaging
- No package manifest or standalone install surface is present in the supplied repository text
Read from LICENSE, .github/workflows/clawsweeper-dispatch.yml.
What it can do
Generate adversarial test cases
Target system or application specifications → Test cases designed to expose vulnerabilities
Perform red team attacks
Target system endpoints or interfaces → Attack results and security weaknesses identified
Execute penetration testing
Network or application access points → Security assessment report with vulnerabilities
Simulate malicious user behavior
User interface or API endpoints → Behavioral patterns and system responses
Generate exploit payloads
Known vulnerability details → Crafted exploit code or data
Analyze security defenses
Security controls and configurations → Defense bypass strategies and recommendations
Tags
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.