OpenClaw Security Guide

OpenClaw is powerful because it can act. Security therefore starts with the permissions, tools, files, channels, and network paths you give the agent—not with a single toggle.

Use least privilege

Create a dedicated workspace and expose only the directories required for the task. Avoid running as root, mounting a home directory wholesale, or granting write access when read access is enough.

Control Gateway access

Keep a personal Gateway on loopback by default. If you need remote access, use an authenticated, intentional route and verify the origin and device controls. Never expose an unauthenticated control endpoint to the public internet.

Protect credentials

• Use supported credential stores or environment references.
• Keep API keys out of prompts, logs, examples, and repositories.
• Rotate a token after accidental disclosure; deleting the message is not enough.
• Give channel bots only the permissions they require.

Treat Skills and plugins as code

Read third-party instructions and referenced scripts before enabling them. Static analysis can identify downloads, shell commands, or secret access, but it cannot prove that a workflow is safe.

Use the Skill security guide for instruction review and the Plugins guide for runtime extensions. A plugin can add executable code, services, providers, channels, hooks, and tools; its review must cover more than SKILL.md.

Maintain a capability inventory

Audit and observe

Use the security audit and diagnostic commands supported by your installed version, then inspect actionable findings:

openclaw security audit
openclaw doctor
openclaw status --all

Expected result

There are no unauthenticated remote binds, unexpected privileged tools, exposed tokens, or unreviewed third-party capabilities in the active agent.

Re-run the review after adding a channel, model provider, Skill, plugin, mount, or remote access path. Security changes when the agent’s reach changes.