OpenClawSkills
GitHub
Core Security • TutorialHeader.readTime

Security Guide

How OpenClaw handles authentication, sandboxing, and access control across messaging channels.

Trusted Input Warning

OpenClaw connects to real messaging surfaces. Treat all inbound Direct Messages (DMs) as untrusted input. This guide explains how to secure your installation.
Tutorial.step

Security Model Overview

OpenClaw uses a layered security approach to protect your host system:

  • DM Pairing: Unknown senders require explicit owner approval before the agent responds.
  • Sandboxing: Isolation of tools within Docker containers for untrusted sessions.
  • Tool Policies: Granular "Allow" and "Deny" lists for specific agent capabilities.
  • Allowlists: Fine-grained control over which contacts and groups can interact with the bot.
  • Local-First: All sensitive data, memories, and configurations stay on your hardware.
Tutorial.step

DM Access & Pairing

By default, OpenClaw is locked. When an unknown user messages you on Telegram, WhatsApp, or Discord:

Pairing Flow (dmPolicy=pairing)
  1. The bot ignores the message but sends a 6-digit pairing code to the requester.
  2. You (the owner) must approve the code via CLI: openclaw pairing approve <channel> <code>.
  3. Once approved, the sender is added to your local allowlist permanently.
Tutorial.step

Sandbox Configuration

For group chats or sessions with lower trust levels, you should enable Docker sandboxing.

openclaw.json
{
  "agents": {
    "defaults": {
      "sandbox": {
        "mode": "non-main"
      }
    }
  }
}

The non-main mode ensures that any session that isn't your primary DM runs inside an isolated container.

Tool Allow/Deny Lists

Standard Allowed

bash, process, read, write, edit, sessions_*

Standard Denied

browser, canvas, cron, gateway, discord

Tutorial.step

Group Chat Security

In group environments, OpenClaw provides multiple gates:

  • Group Allowlists: Explicitly list which group IDs the bot can join.
  • Mention Gating: Require @mentions for the bot to read or respond (Default).
  • Activation Modes: Control whether the bot listens "Always" or only when summoned.
Tutorial.step

Authentication & Remote Access

The Gateway is bound to 127.0.0.1 (loopback) by default. For remote access, follow these rules:

  • SSH Tunnels: The most secure way to forward the control port.
  • Tailscale: Connect via a secure VPN network.
  • Gateway Tokens: Required if the Gateway is exposed to anything other than localhost.

Security Rule #1

Never expose the Gateway port (18789) directly to the public internet without proper authentication and a reverse proxy.
Tutorial.step

Social Network Security

Connecting your agent to social platforms like OpenClaw Social introduces specific risks:

Prompt Injection: Malicious posts can attempt to hijack your agent via text.
Cross-Agent Manipulation: Untrusted agents may trick your bot into leaking data.
Tutorial.step

Self-Audit & Doctor

Use the built-in diagnostic tool to identify security holes in your setup:

Terminal
openclaw doctor

This checks for risky DM policies, leaky sandbox settings, and missing authentication tokens.

Security Checklist

  • ✓
    DM pairing enabled for all channels
  • ✓
    Group allowlists configured
  • ✓
    Sandboxing enabled for non-main sessions
  • ✓
    Gateway secured with authentication