Securing OpenClaw — sandboxing, ClawScan and the security model

Security securitysandboxclawscanhardening OpenClaw Guide Editorial 📅 2026-09-06 ⏱ 6 min

How OpenClaw sandboxes skills, what ClawScan checks before you install a community skill, and how to run OpenClaw safely on a shared or corporate machine.

OpenClaw runs on your machine and reads your email, so the security model is worth understanding. This guide explains the boundaries the Gateway enforces, the extra steps you can take on a shared or corporate machine, and how to evaluate community skills before installing them.

The trust boundaries

There are three concentric trust boundaries in OpenClaw:

The Gateway — always trusted. It owns the model provider key, the channel tokens and the memory database.
Skills you wrote or reviewed — trusted by you. They run with your user permissions but inside the sandbox.
Community skills from ClawHub — trusted only after you have inspected them or read their ClawScan report.

Every request from a chat channel flows: channel → Gateway → skill → external service. The Gateway is the only component that can read your memory; skills see only what the assistant chooses to pass them.

What the filesystem sandbox does

By default, a skill can only read from these roots:

~/Documents
~/Downloads
~/Desktop
~/.openclaw

Any other path must be opted into explicitly inside the skill:

import { sh } from "openclaw/shell";

await sh("git log --oneline -n 20", {
  cwd: "~/Code/myapp",
  allow: ["~/Code/myapp"]
});

If a skill tries to read outside the allowed roots the call fails with a clear PermissionError. The Gateway logs the attempt and surfaces it in openclaw logs.

The network sandbox

The Gateway also enforces an outbound network policy. Each skill declares the hosts it needs:

name: weather
network:
  allow:
    - wttr.in

Anything else is rejected at the TCP layer. You can inspect the current policy with:

openclaw skills inspect weather --network

allow:
  - wttr.in
deny:  (implicit — everything else)

Skills that need arbitrary outbound access (for example, a "browse the web" skill) must explicitly request --network=any. Such skills are tagged as high-trust on ClawHub and their ClawScan reports are stricter.

ClawScan — auditing community skills

Every skill published to ClawHub is graded by ClawScan, an open-source scanner maintained by the OpenClaw Foundation. The score is one of:

Grade	Meaning
A	Minimal permissions, no network, no shell, static type-checked
B	Limited network to declared hosts, scoped filesystem
C	Uses shell but only inside the sandbox
D	Requests `--network=any` or reads secrets
F	Detected unsafe patterns (unbounded loops, untyped eval, prompt-injection vectors)

To inspect a skill before installing:

openclaw skills inspect https://clawhub.ai/skills/web-search@3.2.1

grade:        D
permissions:  network=any
risk:         Prompt-injection vectors in result handling (mitigated by upstream)
source:       github.com/openclaw/web-search
audit:        https://clawscanner.app/reports/web-search@3.2.1

Read the linked audit before installing anything graded C or below.

Running on a shared or corporate machine

If you are on a managed laptop, you can harden the install further:

Run inside a VM or container. The official Docker and Podman images run the Gateway as a non-root user with a read-only root filesystem.
Use a separate user account. Create openclaw as a standard user, give it read-only access to your data folder, and run the Gateway there:

  sudo useradd -m openclaw
  sudo -u openclaw openclaw onboard

Lock down the local dashboard. The Gateway listens on 127.0.0.1 by default. If you need to expose it (for example, to a phone on the same network), bind it to a non-default port and put it behind a reverse proxy with TLS:

  openclaw serve --bind 0.0.0.0:28889 --require-token

Enable system-level logging. The Gateway ships a syslog sink. On macOS it appears in Console.app under user/ULI/OpenClaw; on Linux you can forward it to journalctl.

Audit log

Every skill invocation is logged immutably:

openclaw audit tail --since 24h

2026-09-21 09:14:02  skill=greet           channel=telegram     input={name:"Anna",language:"de"}    duration=412ms
2026-09-21 09:14:18  skill=weather         channel=telegram     input={city:"Vienna"}                duration=1280ms
2026-09-21 09:14:55  skill=inbox.unread    channel=telegram     input={limit:5}                     duration=2310ms

Audit logs are append-only JSONL and are perfect for compliance review.

Reporting a vulnerability

Please email security@openclaw.org (PGP key on the foundation site). For low-severity issues you can also open a GitHub issue.

Next steps

Back up your install regularly — see Getting Started for the tarball incantation.
Wire OpenClaw to your chat apps via Integrations.
When something breaks, head to Troubleshooting.

OpenClaw Guide Editorial

Independently maintained walkthroughs and ecosystem notes for OpenClaw.

Found an issue or have a correction? Get in touch.