Security Best Practices

OpenClaw is a powerful AI agent with deep system access — file read/write, shell commands, browser control, API integrations, and scheduled background execution. This level of access is what makes OpenClaw genuinely useful; it's also what makes it a high-value target for attackers. A misconfigured instance can expose your entire local network. A compromised skill can exfiltrate credentials silently. The security landscape for self-hosted AI agents changed dramatically in 2026. Multiple CVEs were publicly disclosed, including a critical 9.9-severity safeBins bypass and a one-click RCE via WebSocket header validation failure. The ClawHavoc malware campaign embedded 847 malicious skills in ClawHub, several of which achieved thousands of installs before detection. This guide consolidates the practical hardening steps that experienced community members have developed in response — covering network isolation, Docker sandboxing, skill auditing, credential management, and runtime permission controls.

Known Vulnerabilities (2026)

1. Network Security

2. Docker Hardening

3. ClawHub Skill Safety

• Always review source code before installing any skill — check what network requests it makes, what files it reads, and whether it spawns child processes. ClawHub now shows a diff view against the previous version for easy review.
• Verify the publisher's identity and history — look for account age (less than 6 months is a yellow flag), previous skill track record, and whether the username matches known community contributors.
• Pin skill versions explicitly in your config — never use 'latest' in production, because a compromised maintainer account can push a malicious update that reaches every user on 'latest' within hours.
• Check VirusTotal scan results, now integrated directly into ClawHub's plugin detail page — any detection, even by a single vendor, warrants careful review of what the flagged file does.
• Be suspicious of skills requiring 'prerequisites' or external downloads — legitimate skills are self-contained. External download steps are a common vector for delivering malware after the initial review window.
• Monitor skill comments in ClawHub periodically — the community often finds and reports encoded payloads in comments before the automated systems catch them. A sudden spike in negative reviews is a warning sign.
• Restrict tool access using hard tool restrictions in your config — no skill should have write access to .openclaw/ or the ability to call system.which for arbitrary binary discovery unless you've audited exactly why it needs that.

4. Credentials & Secrets

5. Sandbox & Permissions

• Never grant sudo access to OpenClaw agents — there is no legitimate use case that requires agent root access on a personal deployment; any skill claiming to need it is a red flag.
• Use tools.profile = 'session' to restrict per-session permissions — this prevents a skill granted access in one session from retaining that access in subsequent sessions without re-authorization.
• Create explicit allowlists for high-risk tools like screen_record and system.which — these tools can be used for reconnaissance; if no skill you use requires them, block them entirely in your config.
• Maintain separate workspaces for personal and company automation — shared workspaces mean a compromised personal skill could potentially access company API credentials and vice versa.
• Set SOUL.md and AGENTS.md as read-only at runtime to prevent tampering — without this, a malicious prompt injection via web content could rewrite the agent's identity and permission set mid-session.
• Disable implicit workspace plugin autoloads (default since v2026.3.12) — before this default changed, workspace plugins were loaded automatically and could execute code before any review was possible.

6. Keep Updated

OpenClaw updates frequently with critical security patches. Enable the built-in auto-updater or check releases weekly.

Quick Security Checklist