This is a bounded configuration review, not a security or malware-free certification.
Run `openclaw security audit --deep --json` and review host, network, plugins, skills, and external accounts.Security checkup · Independent guidance
OpenClaw security audit and hardening checkup
Run the official security audit first. This page explains supported check IDs and adds a small set of conservative configuration observations. “No findings” means only that the checks run found nothing—not that a deployment is secure, malware-free, or safe to expose publicly.
Current snapshotBrowser-only toolUpdated 2026-08-24Official docs main snapshot · OpenClaw 2026.8.1
Bounded security review
Check exposure and explain audit risk
CHECKUP
Review scope1 bounded observation
Always outside this check
Host compromise, dependency malware, undisclosed vulnerabilities, provider accounts, channel platform enforcement, physical access, and the full runtime behavior of every plugin or skill.
01
Start read-only
- 1
Run the audit
Capture a structured report without changing configuration.
openclaw security audit --json - 2
Review critical findings
Inspect check IDs, paths, and evidence before remediation.
openclaw security audit --deep --json - 3
Apply only understood fixes
`--fix` changes selected policy and permissions; it does not rotate secrets or redesign exposure.
openclaw security audit --fix --json
02
The highest-value boundaries
- Keep the Gateway on loopback unless remote access has explicit authentication and transport protection.
- Use pairing or allowlists for direct messages and groups.
- Treat skills and plugins as code; inspect provenance and declared privileges.
- Separate observation commands from fixes, restarts, token rotation, deletion, and permission changes.
- Rotate a secret if it has appeared in a terminal transcript, screenshot, issue, or pasted report.
Common questions
Before you act
Is the checkup a malware scanner?
No. It explains official results and checks selected config patterns. It cannot certify plugins, skills, hosts, or dependencies as malware-free.
Should I run `--fix` automatically?
No. Read the scope, back up first, and confirm availability impact. The official command intentionally does not rotate tokens or choose your network policy.
Primary sources
Verify against the owner.
OpenClaw security guidanceofficial docs · verified 2026-08-24
OpenClaw security CLIofficial docs · verified 2026-08-24
OpenClaw security audit checksofficial docs · verified 2026-08-24
Content snapshot follows official docs main at the recorded commit; the current package metadata reported 2026.8.1 when verified. Your installed release and live CLI schema remain authoritative.