Book a free strategy call — pick a time that works for you Book Now →
OpenClaw security checklist showing 14-point audit with green checkmarks and red X marks across 5 security layers — 93 percent of DIY installs fail this checklist

OpenClaw Security Checklist: The 14-Point Audit for Production Deployments

“Most self-hosted OpenClaw installs fail at least 6 of these 14 checks. The operators don’t know it until something breaks.”

— Derived from the SecurityScorecard STRIKE team audit, March 2026

This is the 14-point security audit we run on every ManageMyClaw deployment before handoff. We’re publishing it because 93% of DIY OpenClaw installs have at least one critical security gap, and 135,000 instances are publicly exposed right now with operators who believe their firewall is protecting them.

93% of DIY installs have security gaps
135K publicly exposed instances

This checklist isn’t theoretical. Every item maps to a real incident or a known attack vector — the 9 disclosed CVEs, the CNCERT formal security warning, the ClawHavoc supply chain attack (2,400+ malicious skills), and the Summer Yue inbox wipe that earned 10,271 Reddit upvotes. It aligns with the OWASP Top 10 for Agentic Applications, released December 2025 by over 100 security researchers.

Time estimate

First run: ~45 minutes if you know your setup. Recurring quarterly reviews: ~15 minutes. Budget extra time if you find failures — immediate-priority fixes take 5–20 minutes each, but the Composio OAuth migration can take 1–2 hours.

The 14 checks are organized across 5 security layers, matching the framework in our 5 Things You Must Get Right guide. For the full hardening context, see the OpenClaw Security pillar page.

Layer 1 • Container Isolation

Docker Hardening — Checks 1–5

Container isolation is your first line of defense. If an attacker achieves code execution inside the OpenClaw container, these 5 controls determine whether they stay contained or escape to your host. For the full walkthrough, see the Docker sandboxing guide.

1 Container runs as non-root user
What: OpenClaw process runs as UID 1000+, not root

How to verify

docker exec openclaw whoami
# Pass: “openclaw” or any non-root username
# Fail: “root”
PASS: Returns a non-root user (UID 1000+)
FAIL: Returns “root” or “0” — a compromised process has root-level access inside the container
2 –cap-drop=ALL set
What: All Linux capabilities dropped from the container

How to verify

docker inspect --format='{{.HostConfig.CapDrop}}' openclaw
# Pass: [ALL]
# Fail: [] or any partial list
PASS: Output shows [ALL]
FAIL: Empty array or partial list — container inherits NET_RAW, SYS_CHROOT, and other exploitable capabilities
Critical: Docker socket

Check 3 below is the single most dangerous misconfiguration. Mounting the Docker socket gives a container full control over your host. Many tutorials include this mount without explaining the risk. If you only fix one thing today, fix this.

3 Docker socket NOT mounted
What: /var/run/docker.sock is never passed into the container

How to verify

docker inspect openclaw | grep docker.sock
# Pass: no output
# Fail: any line containing /var/run/docker.sock
PASS: No output — socket is not mounted
FAIL: Socket is mounted — container can launch privileged containers, mount the host filesystem, read SSH keys, install persistent backdoors
4 Read-only root filesystem
What: Container filesystem is immutable — attackers can’t modify binaries or install persistence

How to verify

docker exec openclaw touch /test
# Pass: “touch: cannot touch ‘/test’: Read-only file system”
# Fail: no error (file was created)
PASS: Write attempt is rejected with “Read-only file system”
FAIL: File was created — attackers can modify the OpenClaw binary, install malware, or establish persistence on the container filesystem
5 no-new-privileges enabled
What: Prevents processes from gaining additional privileges via setuid/setgid binaries

How to verify

docker inspect --format='{{.HostConfig.SecurityOpt}}' openclaw
# Pass: contains “no-new-privileges:true” or “no-new-privileges”
# Fail: empty array [] or flag is missing
PASS: Output contains no-new-privileges
FAIL: Missing flag — a process inside the container can escalate privileges at runtime even after capabilities are dropped
Layer 2 • Network Perimeter

Firewall & Access Control — Checks 6–8

Network controls determine who can reach your OpenClaw instance. The SecurityScorecard STRIKE team found 135,000 instances publicly exposed — most operators believed their firewall was protecting them. It wasn’t. Docker bypasses UFW. The full configuration walkthrough is in the firewall configuration guide.

6 Gateway bound to 127.0.0.1
What: OpenClaw gateway listens only on localhost, not all interfaces

How to verify

ss -tlnp | grep 3000
# Pass: 127.0.0.1:3000
# Fail: 0.0.0.0:3000 or :::3000
PASS: Bound to 127.0.0.1 only
FAIL: Bound to 0.0.0.0 — reachable from every network interface. CNCERT cited this as the first mitigation to implement.
7 DOCKER-USER chain has deny rules
What: iptables DOCKER-USER chain blocks external access to container ports

How to verify

sudo iptables -L DOCKER-USER -n
# Pass: chain exists with explicit DROP/REJECT rules
# Fail: chain is empty or contains only the default RETURN rule
PASS: DROP/REJECT rules present for container ports
FAIL: Empty chain — all Docker traffic is unrestricted regardless of UFW config. This is the most commonly skipped control.
UFW does NOT protect Docker

Docker manages its own iptables rules and bypasses UFW by design. When Docker publishes a container port, it injects rules that run before UFW’s INPUT chain. An empty DOCKER-USER chain means all Docker traffic is unrestricted — this is why 135,000 instances were exposed while operators thought they were protected.

8 VPN for remote access
What: Remote access via Tailscale/WireGuard — no publicly exposed ports

How to verify

nmap -p 3000 YOUR_PUBLIC_IP
# Pass: port 3000 filtered/closed from the public internet
# Fail: port 3000 open on your public IP
PASS: Port is filtered/closed externally, accessible only via VPN
FAIL: Port is publicly reachable — any scanner can find it. Multiplies your attack surface across every known CVE.
Layer 3 • Credential Management

OAuth & Secrets — Checks 9–10

Raw API tokens in .env files are the credential equivalent of leaving your house keys under the doormat. Composio OAuth puts a middleware layer between your agent and your services. The full migration guide: Composio OAuth setup.

9 Credentials in Composio vault
What: No raw API keys, tokens, or secrets in .env files — all managed via Composio OAuth

How to verify

grep -r "API_KEY\|TOKEN\|SECRET" .env
# Pass: no output (or only Composio connection IDs)
# Fail: any raw API keys, passwords, or OAuth tokens
PASS: No plaintext credentials — only Composio connection references
FAIL: Raw credentials exposed to prompt injection, server compromise, and CVE-2026-04891 (credential logging vulnerability)
10 Kill switch tested
What: You can revoke all agent access from the Composio dashboard in under 60 seconds

How to verify

# In your staging environment:
Composio dashboard → Connections → Revoke → Verify agent stops
# Pass: tested within last 90 days, executable in <60 seconds
# Fail: never tested, or only tested at initial setup
PASS: Kill switch tested within 90 days; you know the exact steps under pressure
FAIL: Untested — Summer Yue had to physically run to her Mac Mini because she had no kill switch. Don’t be Summer Yue.
Incident — The Inbox Wipe 10,271 upvotes

Summer Yue’s OpenClaw agent deleted 200+ emails autonomously. She tried ordering it to stop twice — it didn’t listen. She had to physically run to her Mac Mini and kill the process. The root cause: safety rules were in user messages (compressed away during context compaction), and the agent had unrestricted email access (no tool allowlist). Checks 10, 11, 12, and 14 all address this incident.

Full analysis: The OpenClaw inbox wipe incident

Layer 4 • Agent Permissions

Tool Scoping & Command Blocking — Checks 11–12

Container hardening and network controls protect the infrastructure. Agent permissions protect your data. An agent that can “read email” doesn’t need to “delete email.” These controls scope the blast radius so that even a compromised or hallucinating agent can’t do catastrophic damage.

11 Per-workflow tool allowlists
What: Each workflow/agent has explicit tool scopes — no tools.profile: "full"

How to verify

# Check AGENTS.md for explicit tool scopes:
grep -n "tools\|allowFrom\|profile" AGENTS.md
# Pass: explicit per-workflow tool lists
# Fail: “full”, “all”, or any wildcard permission
PASS: Each workflow lists only the specific tools it needs
FAIL: Blanket permissions — the inbox wipe happened because the agent had unrestricted email access when it only needed read/send
12 Dangerous commands blocked
What: rm -rf, curl|bash, and similar destructive commands are explicitly blocked in AGENTS.md

How to verify

# Check AGENTS.md for explicit command blocks:
grep -n "rm -rf\|curl.*bash\|wget.*sh\|blocked\|deny" AGENTS.md
# Pass: dangerous commands explicitly listed as blocked
# Fail: no mention of blocked commands
PASS: Destructive shell patterns are explicitly denied at the configuration level
FAIL: No command blocking — a prompt injection or compromised skill can execute arbitrary destructive commands

“The allowFrom whitelist is the one most people skip and it’s probably the most important.”

— r/AI_Agents community, February 2026
Layer 5 • Supply Chain & Safety Constraints

Skill Vetting & System Prompts — Checks 13–14

The ClawHavoc attack proved that the ClawHub ecosystem can be weaponized at scale. And the inbox wipe proved that safety rules evaporate if they’re not in the right place. These final two checks protect against supply chain compromise and configuration drift.

13 All ClawHub skills vetted
What: Every installed skill has been cross-checked against the ClawHavoc removal list and manually reviewed

How to verify

# List all installed skills:
openclaw skills list

# For each skill, verify:
# 1. You know what it does and why it’s installed
# 2. Publisher has a verifiable presence
# 3. It requests only necessary permissions
# 4. Cross-check against Koi Security removal list
# 5. Last update within 6 months
PASS: Every skill is known, verified, and current
FAIL: Unrecognized skills present — ClawHavoc delivered the AMOS infostealer targeting SSH keys, browser creds, and crypto wallets
Do not rely on ClawHub’s safety scanner

An independent audit (r/netsec, 77 upvotes, February 2026) analyzed 1,620 OpenClaw skills and found that ClawHub’s built-in scanner labeled 91% of confirmed threats as “benign.” Manual vetting remains the only reliable control.

14 Safety constraints in system prompt
What: Critical safety rules live in the system-level AGENTS.md, not in user messages or chat history

How to verify

# Check Docker config for system-level AGENTS.md:
docker exec openclaw cat /app/AGENTS.md | head -30

# Confirm these rules are in system config (NOT user messages):
# – “do not delete without confirmation”
# – “ask before sending external communications”
# – “never execute shell commands without confirmation”
PASS: Safety rules are in system-level config, preserved through context compaction
FAIL: Rules in user messages or MEMORY.md — context compaction will compress them away during long sessions, exactly how the inbox wipe happened
Assessment • Score Your Deployment

How Did You Score?

Count the checks you passed. Here’s what your score means and what to do next:

0–5
Critical Stop using OpenClaw for anything sensitive immediately. Your deployment has fundamental security gaps. Work through the “Fix Today” triage below before running any workflows with real data.
6–9
At Risk Your deployment has meaningful gaps that need attention this week. You’re not immediately compromised, but you’re one exploit away from a bad day. Start with the highest-severity failures.
10–12
Good Solid baseline. Address remaining failures in your next maintenance window. Schedule quarterly re-audits to catch configuration drift before it becomes a problem.
13–14
Hardened Your deployment meets the full hardening standard. Schedule your next audit for 90 days out, document your configuration, and keep monitoring the CVE tracker for new disclosures.
14/14 Every ManageMyClaw deployment ships at this score — verified before handoff
Remediation • Fix Priority

What to Do If You Fail

Not all failures are equal. Here’s the triage order — work top to bottom, and don’t skip ahead.

Fix Today (immediate)

  • Check 3 (Docker socket mounted): Remove it now. This is container escape territory — full host compromise is one exec call away.
  • Checks 1, 2, 5 (Docker hardening flags): CVE-2026-08441 (CVSS 6.2) is “mitigated via config.” Without these flags, the privilege escalation is active regardless of your OpenClaw version.
  • Check 13 (Unvetted skills): Disable any unrecognized skills immediately. ClawHavoc delivered the AMOS infostealer — SSH keys may already be exfiltrated.
  • Check 14 (Safety rules not in system prompt): Move them. This is the inbox-wipe risk, and it can manifest the next time your agent hits a long conversation.

Fix Within 48 Hours

  • Check 6 (Gateway on 0.0.0.0): Rebind to localhost. Until you do, ensure your DOCKER-USER chain blocks the port externally.
  • Check 7 (Empty DOCKER-USER chain): Add the iptables rule. Firewall configuration guide.
  • Check 9 (Plaintext credentials): Migrate to Composio OAuth. Composio OAuth guide.
  • Check 11 (Blanket tool permissions): Scope down to an allowlist. This limits the blast radius of every other failure on this list.

Fix Within 1 Week

  • Check 4 (No read-only filesystem): Update your compose file with read_only: true. Docker sandboxing guide.
  • Check 8 (No VPN): Set up Tailscale. Free tier covers personal use; setup takes 20 minutes.
  • Check 10 (Kill switch untested): Run the test in staging. Document the steps so you can execute in under 60 seconds.
  • Check 12 (No command blocking): Add explicit deny rules for destructive patterns to your AGENTS.md configuration.
Resources • Deep-Dive Guides

Guides for Each Security Layer

Each layer of this checklist has a corresponding deep-dive guide with full configuration walkthroughs:

Checks Layer Guide
1–5 Container Isolation Docker Sandboxing Guide
6–8 Network Perimeter Firewall Configuration Guide
9–10 Credential Management Composio OAuth Guide
11–12 Agent Permissions 5 Things You Must Get Right
13–14 Supply Chain & Safety ClawHavoc Attack Analysis
1–14 Complete Framework OpenClaw Security Pillar
FAQ • Common Questions

Frequently Asked Questions

How long does the full 14-point audit take?

About 45 minutes for a first-time run if you know your setup. Recurring quarterly reviews take about 15 minutes. If you find failures, budget extra — the Composio OAuth migration (check 9) can take 1–2 hours, and the DOCKER-USER chain setup (check 7) takes 30–90 minutes.

Why doesn’t UFW protect my OpenClaw Docker container?

Docker injects its own iptables rules that run before UFW’s INPUT chain. An empty DOCKER-USER chain means all Docker traffic is unrestricted, regardless of your UFW rules. The fix is adding rules to the DOCKER-USER chain specifically. Full walkthrough in the firewall configuration guide.

Which check is the single most important?

It depends on your current state. If your Docker socket is mounted (check 3), that’s container escape — fix it now. If you have unvetted skills (check 13), the AMOS infostealer may already be running. If everything else is solid, the DOCKER-USER chain (check 7) is the most commonly missing control. See the 5 Things guide for the full priority framework.

Do I need to run all 14 checks every quarter?

Yes, but recurring runs are fast (∼15 minutes). Infrastructure controls (checks 1–8) rarely drift, but agent permissions (checks 11–12), installed skills (check 13), and safety constraints (check 14) can change any time someone updates a workflow. The quarterly cadence catches drift before it becomes a vulnerability.

I scored 13/14. Is one failure acceptable?

It depends which one. A missing VPN (check 8) with a properly configured DOCKER-USER chain is a calculated risk. A mounted Docker socket (check 3) at any score is a critical vulnerability. Use the triage priority above to assess whether your specific failure is tolerable or requires immediate action.

Can I automate this checklist?

Checks 1–9 can be scripted — they’re all terminal commands with deterministic pass/fail output. Checks 10–14 require human judgment: testing the kill switch, reviewing tool permissions, vetting skills, and verifying safety constraint placement. ManageMyClaw Managed Care automates the scriptable checks and performs the manual checks monthly.

Running this audit takes 45 minutes. Maintaining it takes forever.

New CVEs drop monthly. Docker configs drift. Skills get compromised. The audit isn’t a one-time event — it’s an ongoing operational burden. That’s why Managed Care exists: continuous monitoring, CVE patches within 24 hours, and monthly configuration drift checks so you never fall below 14/14.

ManageMyClaw Includes All 14 Checks by Default Every deployment ships hardened, verified, and documented. Managed Care keeps it that way — CVE patches within 24 hours, monthly drift checks, tested backups on every major update. Starting at $499 for deployment, $299/month for ongoing care. See Pricing & Plans

This checklist aligns with the OWASP Top 10 for Agentic Applications (December 2025). For the complete security framework, see OpenClaw Security. For why this matters to founders, see Why Every Founder Needs an AI Agent in 2026.