OpenClaw Security Guide: Hardening Your Setup

OpenClaw is a powerful tool for building and running AI agents. It's also, without proper configuration, a significant security risk. This guide covers everything you need to secure your installation.

Step 1: Update to the Latest Version

# Check current version
opclaw --version

# Update to latest
npm update -g openclaw

# Verify update
openclaw --version

Versions below 0.13.2 are vulnerable to WebSocket hijacking (CVE-2026-25253). Versions below 0.12.8 are vulnerable to command injection (CVE-2026-24763). Patch these immediately.

Step 2: Harden Your Config

# Disable debug mode (prevents log exposure)
openclaw config set debug false

# Enable skill signature verification
openclaw config set require_skill_signatures true

# Restrict network access to allowlist
openclaw config set network_mode allowlist

# Enable audit logging
openclaw config set audit_log true
openclaw config set audit_log_path ~/.openclaw/audit.log

Step 3: Vet Every Skill Before Installing

• Never install a skill directly from ClawHub without scanning it first
• Use GitOpenClaw's free scanner on every skill URL
• Check the GitHub repo for the skill — look at actual code, not just the description
• Verify the publisher — look for a track record and verify their GitHub identity
• Never install skills with curl | bash install commands
• Be suspicious of skills with unusually high install counts and few reviews

Step 4: Set Up Runtime Monitoring

After installation, you need to know what your agents are actually doing. The GitOpenClaw Watch layer monitors every tool call, file access, and network request in real time.

# Install the connector (Teams plan)
npm install -g @gitopenclaw/connect

# Run the connector with your API key
gitopenclaw-connect --key YOUR_API_KEY

Step 5: Review File and Credential Access

No skill should access ~/.ssh/, ~/.aws/, or .env files unless explicitly required for its documented functionality. If a skill accesses these paths, that's a red flag that warrants immediate investigation.