Security Assessment Complete

Your OpenClaw gateway is publicly accessible on the internet without any authentication. This allows anyone to send requests to your AI agent, potentially causing unauthorized access, data exfiltration, or resource exhaustion.

{
  "gateway": {
    "bind": "127.0.0.1",
    "authentication": {
      "enabled": true,
      "method": "token",
      "token": "GENERATE_SECURE_TOKEN"
    },
    "rate_limiting": {
      "enabled": true,
      "requests_per_minute": 60
    }
  }
}

Found 2 unverified skills with dangerous permissions (file-manager, custom-skill). These skills have not been vetted and request file system and network access.

# Enable skill vetting
{
  "skills": {
    "require_verification": true,
    "scan_before_install": true,
    "blocked_permissions": [
      "file_system_write",
      "shell_execution"
    ]
  }
}

Memory is not sandboxed between sessions. Cross-session data leaks are possible if an attacker can manipulate memory pointers.

{
  "memory": {
    "sandboxing": {
      "enabled": true,
      "per_session": true,
      "cross_session_isolation": true
    }
  }
}