OpenClaw Security Check

Fast 10-point security audit for OpenClaw config + host. Read-only by default, optional auto-fix.

Quick Start

Run the bundled script for a non-interactive report:

CODEBLOCK0

Or tell the agent: "run a security check" / "audit my OpenClaw config".

What It Checks

#	Check	Severity if failed	What it looks at
1	Gateway Bind	CRITICAL	INLINECODE0 — must be loopback, not INLINECODE1
2

Gateway Auth | CRITICAL | gateway.auth.mode — must not be off/none | | 3 | Token Strength | HIGH | gateway.auth.token — must be ≥32 chars | | 4 | DM Policy | HIGH | Per-channel dmPolicy — open without allowFrom is dangerous | | 5 | Group Policy | HIGH | Per-channel groupPolicy — open/any allows strangers to trigger the agent | | 6 | Config Permissions | MEDIUM | File mode of openclaw.json — should be 600 or 400 | | 7 | Plaintext Secrets | MEDIUM | Scans config values for keys matching password/secret/apiKey/privateKey | | 8 | Host Firewall | HIGH | UFW or firewalld must be installed and active | | 9 | SSH Hardening | MEDIUM | PasswordAuthentication and PermitRootLogin in sshd_config | | 10 | Exposed Ports | MEDIUM | Count of non-loopback listening ports (>8 = FAIL) |

Auto-Fix Flow

If any item is FAIL or WARN, offer fixes. Always confirm with the user first.

Fix Recipes

#1 Gateway Bind → FAIL:
Set gateway.bind to "loopback". Use openclaw CLI if available, otherwise edit openclaw.json.

#2 Gateway Auth → FAIL:
Set gateway.auth.mode to "token". Generate a strong token if missing:
CODEBLOCK1

#3 Token Strength → FAIL/WARN:
Replace with a new 48-char hex token: openssl rand -hex 24.
Warn user that paired clients will need the new token.

#4 DM Policy → FAIL:
Set affected channels to "dmPolicy": "pairing", or add specific IDs to allowFrom.

#5 Group Policy → FAIL:
Set affected channels to "groupPolicy": "allowlist".

#6 Config Permissions → FAIL/WARN:
CODEBLOCK2

#7 Plaintext Secrets → WARN:
Cannot auto-fix safely. Advise moving secrets to environment variables or .env.local.

#8 Host Firewall → FAIL:
CODEBLOCK3

#9 SSH Hardening → WARN:

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
sudo sed -i 's/^#*PasswordAuthentication .*/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo sed -i 's/^#*PermitRootLogin .*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo sshd -t && sudo systemctl reload ssh

CRITICAL: Ensure key-based SSH access works in a separate session before closing current one.

#10 Exposed Ports → WARN/FAIL:
Review with ss -ltnp, close unnecessary services, or restrict with firewall rules.

Fix Rules

• - Backup first: INLINECODE24
• Merge, don't overwrite: Modify only the specific keys, preserve everything else.
• SSH changes need special care: Always test access in a second session before closing the first.
• Firewall: allow SSH first, enable second. Getting this backwards locks you out.
• After config changes: openclaw gateway restart to apply.
• Re-run the check after fixes to confirm everything passes.

Integration

Heartbeat

Add to HEARTBEAT.md for periodic checks: CODEBLOCK5

Cron

Schedule via OpenClaw cron for standalone audits: CODEBLOCK6

Combining with healthcheck skill

This skill focuses on fast config + host audit (10 checks, <5 seconds). The built-in healthcheck skill provides a full hardening workflow (risk profiling, remediation planning, guided execution). Use this skill for quick checks; escalate to healthcheck for comprehensive hardening.