OpenClaw Security Detector
A comprehensive security detection tool based on the "OpenClaw Minimalist Security Practice Guide" and the "Security Verification and Offense-Defense Drill Manual". It systematically reviews the configuration, permissions, isolation, network, and logs of an OpenClaw instance, and outputs a quantifiable security score and remediation recommendations.
Purpose
The OpenClaw instance runs in a Docker container, with each user having an exclusive container (JoySafeter architecture). This skill is responsible for systematically detecting the security surface of the instance, covering three phases: pre-deployment configuration review, runtime permission verification, and quarantine zone compliance inspection.
Prerequisites
Environment Requirements
- The OpenClaw instance is deployed and accessible (locally or within a container)
- Read permission for the
~/.openclaw/ directory
openclaw.json configuration file is readable
Target Instance Information
- OpenClaw version number (
openclaw --version）
- Deployment mode: local / docker / kubernetes
- Gateway port and binding scope
Core Workflow
- Configuration File Scanning: Parses
openclaw.json, checking for security risks in gateway authentication, binding scope, tool permissions, and model configuration.
- Credential Exposure Detection: Scans configuration files, environment variables, and logs for plaintext API Keys, Tokens, and passwords.
- Gateway Security Audit: Verifies the gateway binding address, authentication method, CORS whitelist, and trusted proxies configuration.
- Tool Permission Verification: Checks
tools.profile settings, verifying file system access scope, command execution permissions, and network access policies.
- File Permission Check: Verifies the permission bits of the
~/.openclaw/ directory and key files, ensuring configuration files cannot be read by other users.
- Quarantine Zone Compliance Check: Scans the
_quarantine directory, listing quarantined skills and the reasons, and verifying whether the quarantine mechanism is functioning properly.
- Runtime Integrity Verification: Verifies the integrity of core files through SHA-256 hash checks, comparing against baseline values from installation.
- Log Audit Analysis: Checks recent operation logs for suspicious patterns (large numbers of failed requests, sensitive operations, red-line trigger records).
- Network Policy Check: Verifies the outbound network request whitelist, DNS resolution scope, and container network isolation status.
Check Item Details
1. Configuration Security Check
| Check Item |
Risk Level |
Detection Rule |
Deduction |
| API Key plaintext exposure |
CRITICAL |
Regex match sk-*, key-*, token: and other patterns |
-20 |
| Gateway bound to 0.0.0.0 |
HIGH |
Check whether gateway.bind is 0.0.0.0 or lan |
-10 |
| Tool permission set to full |
MEDIUM |
tools.profile === "full" |
-5 |
| CORS whitelist too broad |
MEDIUM |
allowedOrigins contains * |
-5 |
| Weak authentication Token strength |
HIGH |
Token length < 32 or entropy < 4.0 |
-10 |
| Device authentication disabled |
HIGH |
dangerouslyDisableDeviceAuth: true |
-10 |
| Model context too large |
LOW |
contextWindow > 200000 |
-2 |
| TLS not configured |
MEDIUM |
Gateway HTTPS not enabled |
-5 |
| Auto-update disabled |
LOW |
update.checkOnStart: false |
-3 |
2. Permission and Isolation Check
| Check Item |
Risk Level |
Detection Rule |
Deduction |
| Configuration file permissions too broad |
HIGH |
openclaw.json Permissions not 600/640 |
-10 |
| Workspace directory permissions |
MEDIUM |
/workspace/ Permissions not 700/750 |
-5 |
| Running as root |
CRITICAL |
Current process UID == 0 |
-20 |
| File system unrestricted |
HIGH |
tools.fs.workspaceOnly: false |
-10 |
| Isolation zone abnormal |
MEDIUM |
_quarantine There are unaudited skills in |
-5 |
3. Network Security Check
| Check Item |
Risk Level |
Detection Rule |
Deduction |
| trusted proxies too broad |
MEDIUM |
Contains /8 large network segment |
-5 |
| No outbound whitelist |
HIGH |
Outbound network restrictions not configured |
-10 |
| Gateway exposed to public network |
CRITICAL |
Port accessible from outside the container |
-15 |
4. Log Audit Check
| Check Item |
Risk Level |
Detection Rule |
Deduction |
| Sensitive operations without logs |
HIGH |
Key operations lack audit records |
-10 |
| Suspicious operation patterns |
MEDIUM |
Large number of abnormal requests in a short time |
-5 |
| Red line trigger records |
CRITICAL |
Triggered security red lines detected |
-15 |
| Log file writable |
MEDIUM |
Log file permissions allow modification |
-5 |
Security Scoring System
Scoring Formula
Base score 100 points, each check deducts points according to risk level:
最终分 = max(0, 100 - Σ 扣分)
Security Level
| Level |
Score Range |
Meaning |
Recommended Action |
| A |
90-100 |
Security status good |
Maintain existing configuration, recheck regularly |
| B |
80-89 |
A few warnings |
Recommend fixing in the next maintenance window |
| C |
70-79 |
Medium risk exists |
Should be fixed within one week |
| D |
60-69 |
Relatively high risk exists |
Requires immediate attention and fixing |
| F |
0-59 |
Serious security issue |
Service must be stopped immediately and fixed |
Example Output
╔══════════════════════════════════════╗
║ OpenClaw 安全检测报告 ║
╠══════════════════════════════════════╣
║ 实例: openclaw-a1b2c3d4 ║
║ 版本: 2026.3.11 ║
║ 部署: Docker 容器 ║
║ 检测时间: 2026-03-13 10:30:00 UTC ║
╚══════════════════════════════════════╝
▶ 配置安全检查
✗ [HIGH] Gateway 绑定范围为 lan，建议收窄为 localhost
✗ [MEDIUM] tools.profile 设置为 full，建议使用 restricted
✗ [HIGH] dangerouslyDisableDeviceAuth 已启用
✓ API Key 未暴露
✓ 认证 Token 强度合格
▶ 权限与隔离检查
✓ 以 node 用户运行 (非 root)
✓ 配置文件权限正常 (600)
✗ [MEDIUM] /workspace/skills 目录权限为 755，建议 750
▶ 网络安全检查
✗ [MEDIUM] trusted proxies 包含 10.0.0.0/8 大段
✓ Gateway 仅容器内可达
▶ 日志审计检查
✓ 最近 24h 无可疑操作
✓ 无红线触发记录
╔══════════════════════════════════════╗
║ 安全评分: B (82/100) ║
║ 严重问题: 0 | 高危: 2 | 警告: 3 ║
╠══════════════════════════════════════╣
║ 修复建议: ║
║ 1. 将 gateway.bind 改为 localhost ║
║ 2. 启用设备认证 ║
║ 3. 将 tools.profile 改为 restricted ║
╚══════════════════════════════════════╝
Tool Categories
| Category |
Tools |
Purpose |
| Configuration parsing |
jq, node (JSON parser) |
Parse the openclaw.json configuration file |
| Credential scanning |
grep, TruffleHog patterns |
Detect plaintext keys and Tokens |
| Permission check |
stat, ls, id |
Verify file permissions and running user |
| Integrity verification |
sha256sum, openssl dgst |
Core file hash verification |
| Network detection |
ss, netstat, iptables |
Port binding and network policy check |
| Log analysis |
grep, jq, awk |
Audit log pattern matching |
Security Principles
- Before: Behavior-layer blacklist + security audit + configuration baseline
- During: Permission narrowing + hash baseline + runtime monitoring
- After: Nightly automatic inspection + explicit reporting + fix tracking
References
references/tools.md - Tool function signatures and parameter descriptionsreferences/workflows.md - Detection process definitions and judgment rules
