Ran openclaw security audit? What Every Finding Means in Plain English
Published 2026-10-18 · Updated 2026-10-18 · By The Is My Agent Safe team
Short answer
openclaw security audit lists findings as critical, warn or info, each with a checkId such as gateway.bind_no_auth. Fix criticals first, starting with anything that lets strangers reach tools or your Gateway. Run it with --deep to add live Gateway and skill code checks. --fix only tightens permissions and group policy, so the rest is manual.
- Critical: fix today. Usually open access plus tools, a reachable Gateway without auth, or readable secrets.
- Warn: fix soon, or write down why you accept it. Often permissions, short tokens or risky tool settings.
- Info: context, such as Tailscale Serve being on or suppressions being active.
- --deep adds a live Gateway check and skill and plugin code scans. --fix doesn't rotate keys, change your bind or remove skills.
How do I run it?
Run these on the machine where your Gateway runs:
openclaw security audit openclaw security audit --deep openclaw security audit --deep --json
The plain audit reads your config, file permissions and install records. --deep also tries a live connection to the running Gateway and scans installed skill and plugin code. --json gives the same findings in a form tools can read. Use --deep whenever you can, because some findings only appear with it.
How do I read the output?
The text output starts with a Summary: line, then CRITICAL, WARN and INFO sections. Each finding has a checkId (a stable name such as fs.config.perms_world_readable), a title, some detail and often a Fix: line. The checkId is the part to search for. Its first word tells you which area of OpenClaw it's about.
Some checkIds are listed as warn/critical. That means the same check can come out at either level depending on your setup. For example, it may be a warning on a loopback-only Gateway and critical once the Gateway is reachable from a network.
What should I fix first?
OpenClaw's own docs give this order:
- Anything "open" with tools enabled. Lock down who can message the agent (pairing or allowlists) first, then tighten tools and sandboxing.
- Public network exposure: a LAN bind, Tailscale Funnel or missing auth. Fix it right away.
- Remote browser control. Treat it like admin access.
- Permissions. State, config, credentials and auth files must not be readable by other users.
- Plugins. Load only what you explicitly trust.
Within each step, do criticals before warnings. Change one thing at a time and re-run the audit after each change, so you know what fixed what.
What do the finding families mean?
fs.* (file permissions)
These are about who else on the machine can read or change OpenClaw's files. ~/.openclaw holds your config, channel credentials, model keys and session transcripts. A world-readable config (fs.config.perms_world_readable) or writable state directory is critical, because another user or process could read your tokens or change your settings. fs.synced_dir warns that your state sits in iCloud, Dropbox or Drive, which spreads copies of your keys and chats.
Fix: the docs want 700 on directories and 600 on files. openclaw security audit --fix and openclaw doctor can tighten these for you. Move state out of synced folders by hand.
gateway.* (who can reach your agent)
The Gateway is the part of OpenClaw that listens on a network port (18789 by default) and serves the Control UI. These findings are the most serious ones:
gateway.bind_no_auth: the Gateway listens beyond your own machine without a shared secret. Critical.gateway.token_placeholder_valueorgateway.password_placeholder_value: the secret is blank or a placeholder. Critical.gateway.token_too_shortorgateway.password_too_short: under 24 characters. Easier to guess.gateway.tailscale_funnel: your Gateway is on the public internet through Tailscale Funnel. Critical.gateway.control_ui.allowed_origins_requiredor_wildcard: the browser dashboard is reachable without a proper list of allowed sites.gateway.trusted_proxies_missingandgateway.real_ip_fallback_enabled: a reverse proxy is in front, but OpenClaw isn't set up to trust it correctly.
Fix: keep gateway.bind on loopback unless you have a reason not to, use token auth with a long random token (openclaw doctor --generate-gateway-token makes one), and reach the dashboard through an SSH tunnel or Tailscale Serve. Our exposure guide walks through checking this from outside.
To change a setting with the CLI, stop the Gateway first. The docs say config set needs the local Gateway stopped:
openclaw gateway stop openclaw config set gateway.bind loopback openclaw gateway start
If you run OpenClaw in Docker, the container image defaults to an exposed bind. Change the setting through your container's config and recreate the container instead.
security.exposure.* and channels.* (who can talk to it)
These combine two things: who can message your agent, and what it can do when they do. security.exposure.open_groups_with_elevated (critical) means an open DM or group can reach tools that run outside the sandbox. channels.<provider>.dm.open (critical) means anyone on that chat app can DM your bot. This is the first item in OpenClaw's fix order for a reason: one message from a stranger can steer the agent's tools.
Fix: use pairing or allowlist for DMs, require mentions in groups, and keep shell and file tools off for any agent that strangers can reach. --fix does switch open group policies to allowlists. It doesn't change DM policy or tools.
tools.exec.* and sandbox.* (what the agent can run)
tools.exec.security_full_configured means the agent can run any shell command on the host. sandbox.dangerous_bind_mount (critical) means the sandbox can see system folders, credential folders or the Docker socket, which defeats the point of a sandbox. tools.exec.auto_allow_skills_enabled means command approvals automatically trust programs that skills bring with them.
Fix: set exec to deny or ask, and turn on the sandbox for anything that reads outside content. The exact settings are in OpenClaw's hardened baseline, which our checklist links to.
skills.* and plugins.* (code you installed)
Plugins run inside the Gateway, and skill folders should be treated as trusted code. skills.code_safety and plugins.code_safety (warn or critical, --deep only) mean OpenClaw's own scan found suspicious patterns in installed code. *.scan_truncated means the scan hit its size limit and didn't read every file. That doesn't mean anything bad was found. It means some files weren't checked. plugins.installs_unpinned_npm_specs and _missing_integrity mean installs aren't pinned to an exact version.
Fix: remove anything you don't recognize, prefer pinned versions, and set an explicit plugins.allow list. A clean code scan is not proof a skill is harmless. The scan looks for patterns and has limits.
browser.*, hooks.* and config.*
browser.control_no_auth (critical) means remote browser control has no token or password. Treat browser control like admin access. hooks.token_reuse_gateway_token (critical) means your webhook token also unlocks the Gateway, so one leak gives away both. config.insecure_or_dangerous_flags means a debug setting starting with dangerously is on. Turn it off outside testing.
When should I worry?
Act today if any of these are true:
- Any critical finding in the
gateway.*,security.exposure.*,browser.*orchannels.*.dm.openfamilies. --deepcouldn't reach your Gateway (gateway.probe_failed) and you don't know why.- A
skills.code_safetyorplugins.code_safetycritical on something you didn't knowingly install.
If you think someone else may already have had access, don't just fix the setting. Follow OpenClaw's incident steps: contain (stop the Gateway and set the bind to loopback), rotate (Gateway token, remote client secrets, model and channel keys), then review logs with openclaw logs and re-run openclaw security audit --deep.
A warning you understand and accept is fine. Write down why, so the next audit doesn't surprise you.
What does --fix do, and what doesn't it do?
openclaw security audit --fix
--fix is deliberately narrow. It does: switch open group policies to allowlists, and tighten state, config and include-file permissions (600 files, 700 directories).
It doesn't: rotate tokens or API keys, disable tools, change your bind, auth or network exposure, or remove plugins and skills. Those are the fixes that matter most for exposure and key theft, and you make them yourself.
What are suppressions?
If you've decided to accept a finding, you can suppress it under security.audit.suppressions in your config. Suppressed findings move out of the main list into suppressedFindings in the JSON output, and the audit always shows security.audit.suppressions.active as an info line. If you see that line on a setup you didn't configure, find out who added the suppressions and why.
Every finding we explain
| checkId | What it means | What to do first |
|---|---|---|
browser.control_no_auth | Browser control is exposed without a password | Turn on gateway auth. |
config.secrets.gateway_password_in_config | Your gateway password is saved in plain text in the config file | Move it to an environment variable or secret reference. |
config.secrets.hooks_token_in_config | Your webhook token is saved in plain text in the config file | Move it to a secret reference. |
discovery.mdns_full_mode | Your agent announces details about this machine on the local network | Switch mDNS to a less revealing mode (check the docs for the values your version supports). |
fs.auth_profiles.perms_readable | Your stored model keys can be read by other users | Tighten permissions, then rotate any key you think was exposed. |
fs.config.perms_world_readable | Every user on this machine can read your agent's config (and keys) | Let OpenClaw tighten the permissions (it uses chmod 600). |
fs.config.perms_writable | Other users can change your agent's config | Tighten permissions. |
fs.credentials_dir.perms_readable | Your channel credentials folder can be read by other users | Tighten permissions. |
fs.state_dir.perms_world_writable | Anyone on this machine can change your agent's state folder | Tighten permissions. |
fs.synced_dir | Your agent's files live in a synced folder (iCloud/Dropbox/Drive) | Move OpenClaw state and config out of the synced folder. |
gateway.auth_no_rate_limit | No limit on password guesses | Add a rate limit (OpenClaw's own suggested values below). |
gateway.bind_no_auth | Your agent's gateway is reachable from other machines without a password | Put the gateway back on this machine only, or turn on token auth before exposing it. |
gateway.control_ui.allowed_origins_required | Your control panel accepts browser connections from any website | List the exact address(es) you open the Control UI from. |
gateway.control_ui.allowed_origins_wildcard | Your control panel trusts every website ('*') | Replace '*' with the exact address you use. |
gateway.control_ui.host_header_origin_fallback | A 'dangerous' origin fallback is switched on | Turn the fallback off. |
gateway.http.no_auth | Your gateway's HTTP API accepts requests without a password | Set an auth mode and generate a token. |
gateway.loopback_no_auth | Your gateway has no password, and a proxy may be forwarding outside traffic to it | Turn on token auth even on loopback when any proxy is involved. |
gateway.probe_failed | The live gateway check couldn't finish | Make sure the gateway is running, then run the audit again. |
gateway.real_ip_fallback_enabled | Your gateway trusts a header that can be faked | Turn the fallback off and list your real proxies. |
gateway.tailscale_funnel | Tailscale Funnel puts your agent on the public internet | Switch from Funnel to Serve, which keeps access inside your tailnet. |
gateway.token_placeholder_value | Your gateway 'password' is a placeholder like 'undefined' | Generate a real token. |
gateway.token_too_short | Your gateway token is short | Generate a new, long token and update anything that uses the old one. |
gateway.trusted_proxy_no_proxies | Proxy login is on, but no proxy is trusted | List your proxy's IPs in gateway.trustedProxies, or switch back to token auth. |
hooks.path_root | Webhooks are served at '/' | Move hooks to their own path and update senders. |
hooks.token_reuse_gateway_token | Your webhook token is the same as your gateway password | Let OpenClaw rotate the hooks token, then update the services that send webhooks. |
hooks.token_too_short | Your webhook token is short | Rotate to a long random token. |
models.small_params | A small model has risky tools | Sandbox those sessions or disable web tools for small models. |
plugins.code_safety | A plugin contains suspicious code | Disable the plugin unless you've reviewed the flagged code. |
plugins.extensions_no_allowlist | Plugins load without an allowlist | List only the plugins you trust in plugins.allow. |
plugins.tools_reachable_permissive_policy | Plugin tools are reachable under a permissive tool policy | Set an explicit plugin allowlist and tighten tools.profile. |
sandbox.dangerous_bind_mount | The sandbox can see sensitive host folders | Remove that bind mount. |
sandbox.dangerous_network_mode | The sandbox shares the host's network | Use a normal bridge network for the sandbox. |
security.audit.suppressions.active | Some audit findings are hidden by your suppressions | Review your suppressions, or paste the --json output (it lists suppressed findings). |
security.exposure.open_channels_with_exec | Shared or public rooms can reach an agent that runs commands | Restrict the room policy or remove exec from that agent. |
security.exposure.open_groups_with_control_plane_tools | Open chats can change your agent's settings or schedules | Lock down open policies and remove gateway/cron tools from those contexts. |
security.exposure.open_groups_with_elevated | Open chats can reach powerful tools | Lock down DMs/groups first (pairing/allowlists), then tighten tools. |
security.exposure.open_groups_with_runtime_or_fs | Open chats can reach command or file tools | Switch open policies to allowlist (OpenClaw can do this), and sandbox the agent. |
skills.code_safety | A skill contains suspicious code | Remove the skill unless you've reviewed the flagged code. |
summary.attack_surface | Attack-surface summary (for information) | Nothing to do; it's a summary. |
tools.exec.agent_skill_mcp_boundary_drift | Skills may reach MCP servers and their credentials | Isolate exec (sandbox/OS user) and scope MCP credentials. |
tools.exec.auto_allow_skills_enabled | Skills can run programs without asking you | Turn off auto-allow for skills in your exec approvals. |
tools.exec.security_full_configured | Your agent can run any command on this machine | If others can message your agent, require approvals or an allowlist for exec. |
What should I do after fixing things?
Re-run openclaw security audit --deep and confirm the criticals are gone. Then work through the rest of our 12-point checklist, which covers what the audit can't see, such as spend limits and versions. For more on OpenClaw specifically, see the OpenClaw hub. To have your output read for you, paste it into the free check. Terms like gateway and loopback are in the glossary.
Frequently asked questions
What does "critical" mean in openclaw security audit?
OpenClaw marks a finding critical when it can directly let someone else control your agent or read its secrets, for example a Gateway reachable without auth or a config file other users can read. Fix these before anything else.
Which findings should I fix first?
OpenClaw's docs give an order: anything open to strangers with tools enabled, then public network exposure, then remote browser control, then file permissions, then plugins. Within that, criticals before warnings.
What does --deep add?
It adds a best-effort live check against your running Gateway and scans installed skill and plugin code. Findings such as skills.code_safety and gateway.probe_failed only appear with --deep.
Does --fix fix everything?
No. It switches open group policies to allowlists and tightens file permissions. It doesn't rotate tokens or API keys, disable tools, change your bind, auth or network exposure, or remove plugins and skills.
Is a clean audit enough?
It's a good sign, not a guarantee. The audit doesn't check your provider spend limits or what changes after it runs, and a code scan can't judge everything a skill does. Re-run it after every upgrade, new skill or config change.
Sources
- OpenClaw docs: openclaw security (CLI)
- OpenClaw docs: running the security audit
- OpenClaw docs: security audit checks (checkId catalog)
- OpenClaw docs: network exposure
- OpenClaw docs: secrets, storage and logs
- OpenClaw docs: openclaw config (CLI)
- OpenClaw docs: operator incident response
Get the weekly plain-English agent security brief
Agents & AI Security, explained: one short email a week. Free. Unsubscribe any time.
We'll only use your email to send the newsletter. Privacy policy.