Security Operator

Security Operator v2.0

Runtime security guardrails for OpenClaw. This skill defines how you operate during autonomous missions, not just how to audit once.

Quick start

If you just want protection now: 1. Read the "Always-on guardrails" section below 2. Follow those rules during all work 3. Run the setup wizard when you have 10 minutes

If you want full setup: 1. Run the setup wizard (Workflow A) 2. The wizard configures OpenClaw and writes guardrails to AGENTS.md 3. Guardrails apply automatically to all future sessions

Operating modes

Two modes. Research stays fast, execution stays safe.

Research Mode (default)

Allowed:

Not allowed:

Execution Mode (autonomous, guarded)

Allowed:

Hard rule:

Always-on guardrails

These apply in BOTH modes, always.

1. Untrusted content boundary

2. Prompt injection detection

Then:

3. High-risk action gates

4. Lockout prevention

5. Cost awareness

Do not:

6. Credential hygiene

If you need to use credentials:

7. Memory integrity

8. Cascade limits

Workflows

A. Setup wizard (run once, ~10 min)

Run this to configure OpenClaw security settings and write guardrails to your workspace.

Step 1: Check current security posture

openclaw security audit --deep
openclaw status

Step 2: Apply safe defaults

openclaw security audit --fix

Step 3: Verify spending limits Check if spending limits are configured. If not, recommend setting them.

Step 4: Verify logging Check if logging is enabled and logs are being written.

ls -la /tmp/openclaw/ 2>/dev/null || echo "Check log location in config"

Step 5: Check execution context

# Container check
cat /proc/1/cgroup 2>/dev/null | grep -q docker && echo "Running in container" || echo "Not containerized"
Running as root? (bad)
whoami

Step 6: Write guardrails to AGENTS.md Append the "Always-on guardrails" section to the user's AGENTS.md so they persist across sessions.

Ask user: 1. "Do you want me to add the security guardrails to your AGENTS.md?" 2. If yes, append the guardrails section

Step 7: Schedule periodic audit (optional) Offer to schedule a weekly security check via cron:

openclaw cron add --name "security-operator:weekly-audit" --schedule "0 10 * * MON" --payload "Run openclaw security audit and report any issues"

B. OpenClaw security audit (read-only)

Quick audit you can run anytime.

openclaw security audit --deep
openclaw update status

Summarize:

Offer options: 1. Apply safe defaults: openclaw security audit --fix 2. Show detailed findings only 3. Schedule periodic audits

C. Credential audit

Check for common credential mistakes.

# Check for plaintext keys in config (not .env)
grep -r "API_KEY\|SECRET\|TOKEN\|PASSWORD" ~/.openclaw/*.json 2>/dev/null | grep -v ".env"
Check .env file permissions
ls -la ~/.openclaw/.env 2>/dev/null
Check skill folders for hardcoded keys
grep -r "sk-\|api_key.*=" ~/.openclaw/skills/*/SKILL.md 2>/dev/null | head -5

Flag:

D. Skill vetting (before installing community skills)

Important: ClawHub security scans can have false negatives. A "clean" scan does not guarantee safety. Always run your own checks.

Layer 1: Check ClawHub security inspection

Layer 2: Run your own inspection (even if ClawHub says clean)

Scan the skill files yourself for:

# Dangerous shell patterns
grep -rE "(curl|wget|bash|sh|eval|exec)\s" ./skill-folder/
Network calls to external endpoints
grep -rE "(http://|https://|fetch|request|axios)" ./skill-folder/
Credential/secret access patterns
grep -rE "(API_KEY|SECRET|TOKEN|PASSWORD|\.env|credentials)" ./skill-folder/
Base64 obfuscation (common in malicious code)
grep -rE "base64|atob|btoa" ./skill-folder/
Encoded/obfuscated strings
grep -rE "\\\\x[0-9a-f]{2}|\\\\u[0-9a-f]{4}" ./skill-folder/
File system access outside skill folder
grep -rE "(\/etc\/|\/root\/|~\/\.|\.\.\/)" ./skill-folder/

Layer 3: Check permissions requested in metadata

Decision matrix: | ClawHub Status | Your Scan | Action | |----------------|-----------|--------| | Clean | Clean | OK to install | | Clean | Suspicious | DO NOT install, review manually | | Flagged | Any | DO NOT install | | No scan | Any | Run full manual review first |

If anything looks suspicious:

D2. Update security check (after updating skills)

Critical: When running clawhub update --all or updating individual skills, malicious code could be introduced in new versions. ClawHub scans may not catch everything.

Before updating, run pre-flight check:

# See what updates are available
clawhub list --outdated
For each skill, check ClawHub security status
Then decide which to update

After any skill update, automatically:

1. Check ClawHub security status for updated skills (first pass)

2. Run your own diff inspection (defense in depth):

   # Compare old vs new version for suspicious additions
   # Look for new:
   # - Shell commands (curl, wget, bash, exec)
   # - Network endpoints
   # - Credential access
   # - Obfuscated code
   

3. Red flags in updates: - New network calls that weren't there before - New shell command execution - New credential/env var access - Obfuscated or minified code added - Significant size increase without clear reason

4. If an update looks suspicious: - Alert the user immediately - Do not use the skill until reviewed - Rollback: clawhub install skillname --version

Safe update workflow:

1. "Check which skills have updates available and their ClawHub security status"
2. "Download updates but don't activate yet"
3. "Scan the updated files for new dangerous patterns"
4. "Show me anything suspicious before I approve"
5. "Activate only the ones that pass all checks"

Paranoid mode (recommended for production):

E. VPS baseline hardening (workshop-safe)

For users running on VPS who want basic hardening without breaking access.

Quick checklist (no changes, just verify):

Optional hardening script: If the skill includes scripts/install.sh:

Covers: updates, UFW baseline, SSH hardening (with lockout safety), unattended security updates.

F. Periodic health check (for cron)

Lightweight check to run on schedule.

openclaw security audit
openclaw update status

Output format:

If issues found, notify user. If clean, log silently.

What this skill does NOT do

References

Token cost

The goal is protection without bloat.

If you just want protection now: 1. Read the "Always-on guardrails" section below 2. Follow those rules during all work 3. Run the setup wizard when you have 10 minutes

If you want full setup: 1. Run the setup wizard (Workflow A) 2. The wizard configures OpenClaw and writes guardrails to AGENTS.md 3. Guardrails apply automatically to all future sessions