OpenClaw Tip #16: Run security audits + auto-fix

OpenClaw setups tend to get riskier over time: you add channels, install new plugins, loosen tool policies, or move the gateway behind a proxy. A fast way to catch drift is to run the built-in security audit regularly and treat the results as an operational checklist.

Step 1: Run the baseline security audit

From the machine running OpenClaw, start with the default audit:

openclaw security audit

This is designed to flag common foot-guns (like overly-open permissions on your OpenClaw state directory) before they turn into incidents.

Step 2: Run the deep audit after major changes

After connecting a new channel, changing gateway exposure, or installing a plugin/skill, run the deeper pass:

openclaw security audit --deep

Use this version when you want a more comprehensive review before you “go live.”

Step 3: Export JSON so you can track improvements over time

If you want to track hardening work (or share findings with a teammate), export machine-readable output:

openclaw security audit --json > openclaw-security-audit.json

Tip: commit the JSON to a private repo or store it alongside your ops notes (not in a public place), because it may contain sensitive paths and environment details.

Step 4: Apply safe auto-fixes (then re-run)

When the audit reports issues that OpenClaw can safely remediate, apply them with:

openclaw security audit --fix

Then immediately re-run the audit to confirm the state is clean:

openclaw security audit --deep

Step 5: Manually verify the most important permission checks

Even if you use --fix, it’s useful to know the baseline targets. A common hardened posture is:

~/.openclaw is 700 (only your OpenClaw OS user can access it).
~/.openclaw/openclaw.json is 600 (only readable/writable by that user).

Remember: OpenClaw session transcripts are stored on disk (for example under ~/.openclaw/agents/<agentId>/sessions/*.jsonl), so filesystem access is effectively the trust boundary.

Related OpenClaw tips

Rule of thumb: run openclaw security audit weekly, run --deep after any meaningful change, and treat every red finding as a reason to reduce scope (tools, channels, filesystem) before adding more power.