Security

text

Copy

openclaw security

Security tools (audit + optional fixes).

Related:

• Security guide: Security

Audit

bash
Copy
openclaw security audit
openclaw security audit --deep
openclaw security audit --deep --password <password>
openclaw security audit --deep --token <token>
openclaw security audit --fix
openclaw security audit --json

The audit warns when multiple DM senders share the main session and recommends secure DM mode:

(or for multi-account channels) for shared inboxes. This is for cooperative/shared inbox hardening. A single Gateway shared by mutually untrusted/adversarial operators is not a recommended setup; split trust boundaries with separate gateways (or separate OS users/hosts). It also emits when config suggests likely shared-user ingress (for example open DM/group policy, configured group targets, or wildcard sender rules), and reminds you that OpenClaw is a personal-assistant trust model by default. For intentional shared-user setups, the audit guidance is to sandbox all sessions, keep filesystem access workspace-scoped, and keep personal/private identities or credentials off that runtime. It also warns when small models () are used without sandboxing and with web/browser tools enabled. For webhook ingress, it warns when reuses the Gateway token, when is short, when , when is unset, when is unrestricted, when request overrides are enabled, and when overrides are enabled without . It also warns when sandbox Docker settings are configured while sandbox mode is off, when uses ineffective pattern-like/unknown entries (exact node command-name matching only, not shell-text filtering), when explicitly enables dangerous node commands, when global is overridden by agent tool profiles, when open groups expose runtime/filesystem tools without sandbox/workspace guards, and when installed plugin tools may be reachable under permissive tool policy. It also flags (header-spoofing risk if proxies are misconfigured) and (metadata leakage via mDNS TXT records). It also warns when sandbox browser uses Docker network without . It also flags dangerous sandbox Docker network modes (including and namespace joins). It also warns when existing sandbox browser Docker containers have missing/stale hash labels (for example pre-migration containers missing ) and recommends . It also warns when npm-based plugin/hook install records are unpinned, missing integrity metadata, or drift from currently installed package versions. It warns when channel allowlists rely on mutable names/emails/tags instead of stable IDs (Discord, Slack, Google Chat, Microsoft Teams, Mattermost, IRC scopes where applicable). It warns when leaves Gateway HTTP APIs reachable without a shared secret ( plus any enabled endpoint). Settings prefixed with / are explicit break-glass operator overrides; enabling one is not, by itself, a security vulnerability report. For the complete dangerous-parameter inventory, see the "Insecure or dangerous flags summary" section in Security.

SecretRef behavior:

• text

  Copy

  security audit
  resolves supported SecretRefs in read-only mode for its targeted paths.
• If a SecretRef is unavailable in the current command path, audit continues and reports
  text

  Copy

  secretDiagnostics
  (instead of crashing).
• text

  Copy

  --token
  and
  text

  Copy

  --password
  only override deep-probe auth for that command invocation; they do not rewrite config or SecretRef mappings.

JSON output

Use

for CI/policy checks:

bash
Copy
openclaw security audit --json | jq '.summary'
openclaw security audit --deep --json | jq '.findings[] | select(.severity=="critical") | .checkId'

If

and are combined, output includes both fix actions and final report:

bash
Copy
openclaw security audit --fix --json | jq '{fix: .fix.ok, summary: .report.summary}'

What

text

Copy

--fix

changes

applies safe, deterministic remediations:

• flips common
  text

  Copy

  groupPolicy="open"
  to
  text

  Copy

  groupPolicy="allowlist"
  (including account variants in supported channels)
• when WhatsApp group policy flips to
  text

  Copy

  allowlist
  , seeds
  text

  Copy

  groupAllowFrom
  from the stored
  text

  Copy

  allowFrom
  file when that list exists and config does not already define
  text

  Copy

  allowFrom
• sets
  text

  Copy

  logging.redactSensitive
  from
  text

  Copy

  "off"
  to
  text

  Copy

  "tools"
• tightens permissions for state/config and common sensitive files (
  text

  Copy

  credentials/*.json
  ,
  text

  Copy

  auth-profiles.json
  ,
  text

  Copy

  sessions.json
  , session
  text

  Copy

  *.jsonl
  )
• also tightens config include files referenced from
  text

  Copy

  openclaw.json
• uses
  text

  Copy

  chmod
  on POSIX hosts and
  text

  Copy

  icacls
  resets on Windows

does not:

• rotate tokens/passwords/API keys
• disable tools (
  text

  Copy

  gateway
  ,
  text

  Copy

  cron
  ,
  text

  Copy

  exec
  , etc.)
• change gateway bind/auth/network exposure choices
• remove or rewrite plugins/skills

Related

• CLI reference
• Security audit