OpenClaw Module 3: Security & Permissions
Goal: turn OpenClaw security guidance into a concrete checklist you can run and rerun in CI or ops playbooks.
Run audits in a controlled environment first. Treat findings as input to your org’s own security review, not a full replacement.
Hands-on Steps (Directly Runnable)
Execute each command, capture output, then note issues and fixes.
Step 1: Run a baseline security audit
Start with a human-readable report:
openclaw security audit
For deeper checks (DM scopes, sandbox, hooks, webhooks, plugins):
openclaw security audit --deep
Skim the summary and note any high or critical warnings (shared DM scopes, open group policies, sandbox disabled with browser tools, etc.).
openclaw security auditopenclaw security audit --deepStep 2: Export findings for CI / policy checks
Produce JSON output you can feed into scripts:
openclaw security audit --json | jq ' .summary '
openclaw security audit --deep --json | jq ' .findings[] | select(.severity=="critical") | .checkId '
Store these reports under your ops or security repository so you can track drift over time.
openclaw security audit --json | jq ' .summary 'openclaw security audit --deep --json | jq ' .findings[] | select(.severity=="critical") | .checkId 'Step 3: Apply safe automatic fixes where possible
Let OpenClaw apply deterministic remediations:
openclaw security audit --fix
Or combine with JSON output:
openclaw security audit --fix --json | jq ' {fix: .fix.ok, summary: .report.summary} '
--fix focuses on safe changes: tightening file permissions, enabling logging.redactSensitive, closing obvious group-policy oversharing, etc. It does not remove plugins, rotate keys, or change gateway exposure on its own.
openclaw security audit --fixopenclaw security audit --fix --json | jq ' {fix: .fix.ok, summary: .report.summary} 'Step 4: Re-run `openclaw doctor` after fixes
After applying fixes, run:
openclaw doctor --deep
Confirm that gateway, sandbox, and channels all look healthy, and that any remaining warnings are either acceptable or queued for manual remediation.
openclaw doctor --deepContinue to the next module
Turn the commands on this page into your team runbook.