Run a security audit first
Before manual checks, run the built-in audit:
openclaw security audit --deep
To auto-fix known issues:
openclaw security audit --fix
Check gateway auth:
openclaw config list | grep gateway.auth
If empty, enable auth:
openclaw config set gateway.auth.mode token
openclaw config set gateway.auth.token your-secure-token-here
Three-layer security model
| Layer | Purpose | How to check |
|---|---|---|
| Docker network isolation | Restricts container network access | docker network ls |
| Sandbox tool filtering | Limits Agent-accessible system resources | openclaw config list | grep sandbox |
| Agent tool permissions | Limits tools per Agent | openclaw security audit --deep |
Pre-install checklist
- I know where this skill or integration comes from
- I know who maintains it (prefer verified badge on ClawHub)
- I have seen recent updates or docs
- I know what resources it will access
- I have checked the repo or source if it is not official
Verify installed skills:
openclaw skills list
openclaw doctor
Pre-channel checklist
- I know who will see it
- I will test in a controlled group first
- I know how to disable it if something goes wrong
- For Feishu: I know if I am using official, hosted, or community plugin
Check gateway and channels:
openclaw gateway status
Pre-permission checklist
- This permission matches the task at hand
- I will start with minimum permissions
- I know where config, logs, and rollback points are
- I will verify write actions by reading back
Check current permissions:
openclaw config list | grep -E "auth|permission|sandbox"
30-second pre-launch checklist
- I know where it comes from
- I know what it will read, write, and send
- I know how to stop, roll back, and check logs if it fails
- I am granting minimum permissions, not maximum
- I have tested in a staging or test group
- I have run
openclaw security audit --deep