Hardening OpenClaw — the day-1 checklist.

OpenClaw is a process that runs arbitrary code (your skills), drives a real browser (which can be tricked), and holds API keys for downstream services. Treat it like you'd treat a service account that has all of your team's credentials — because that's what it is.

The realistic threats, in rough order of likelihood:

• You install a malicious skill from a random ClawHub publisher and it exfiltrates your tokens.
• You expose the gateway to the internet without auth and someone discovers it.
• The agent gets prompt-injected via a web page or email and is convinced to do something it shouldn't.
• Your laptop is stolen while OpenClaw is running and the disk isn't encrypted.
• An LLM provider key leaks and someone runs up a $5,000 bill.

The day-1 hardening below addresses all five.

The single most common OpenClaw security mistake is running the gateway as root. The installer warns you. The docs warn you. People still do it. Don't.

# As root, on a fresh VPS:
adduser openclaw
usermod -aG sudo openclaw
mkdir -p /home/openclaw/.openclaw
chown -R openclaw:openclaw /home/openclaw/.openclaw
chmod 700 /home/openclaw/.openclaw

# Switch users and install
su - openclaw
curl -fsSL https://openclaw.ai/install-cli.sh | bash

The gateway listens on port 18789 by default. There is no built-in authentication. If that port is reachable from the internet, your agent can be controlled by anyone.

{
  "gateway": {
    "host": "127.0.0.1",
    "port": 18789
  }
}

If you need remote access:

• SSH tunneling. ssh -L 18789:localhost:18789 user@vps — simple, secure, requires nothing extra.
• Tailscale. Installs in 60 seconds, WireGuard-based mesh, perfect for "my laptop and my VPS."
• Reverse proxy with auth. Caddy + basic auth or OAuth2-proxy in front. More moving parts; only bother if you genuinely need a public URL.

Sandbox mode confines skill execution. With it on, a malicious or buggy skill can't read your SSH keys, can't write to /etc, can't escape into a shell session.

{
  "sandbox": {
    "mode": "all",
    "tools": {
      "exec": { "allowedPaths": ["~/workspace"] },
      "browser": { "allowedDomains": "*" }
    }
  }
}

Three modes:

Anthropic and OpenAI both let you create per-key spending limits. Use them.

• Separate key per environment. Production agent ≠ staging agent ≠ your personal experiments. If one leaks, only one set of work breaks.
• Hard monthly cap. Set it 2x your expected spend. A runaway agent can burn through $5,000 in a day — the cap is the brake.
• Restrict by IP if your provider supports it. Anthropic doesn't yet; OpenAI does. Use it on production keys.
• Rotate quarterly. Anthropic's console takes 30 seconds. Keep the rotation in a recurring calendar event.

ClawHub has 13,729 skills. Most are fine. A few are not. The install command runs the skill's setup phase; that setup phase can do anything the OpenClaw user can do.

• Read the SKILL.md before installing. If it's vague, opaque, or asks for credentials in weird ways, skip it.
• Check the publisher. ClawHub shows publisher account age and skill count. New accounts with one popular skill are the highest-risk pattern.
• Glance at the source. Most skills are <200 lines. A skim catches "phone home to an attacker domain" 95% of the time.
• Pin versions. An auto-updating skill is a backdoor waiting to happen.

OpenClaw ships a security auditor that catches the obvious configuration mistakes: bound to 0.0.0.0, root user, sandbox off, world-readable state directory, known-bad skill versions.

openclaw security audit --deep

Run it after every install, after every config change, and once a month on a cron just to catch drift.

If something goes wrong — the agent gets prompt-injected, a skill turns out to be malicious, your laptop is stolen — you need a way to stop it instantly. The fastest kill switch is revoking the LLM API key.

Bookmark the keys page in your browser today. If it takes you 30 seconds to find when you need it, that's 30 seconds of ongoing damage.

Click each one as you complete it. Bookmark this page; the progress saves in your browser.