Openclaw Secure Stack

OpenClaw Secure Stack

**Version 1.1.0** | [Changelog](CHANGELOG.md)

A hardened deployment wrapper that makes OpenClaw safe to self-host. Wraps an unmodified OpenClaw instance with authentication, skill scanning, prompt injection mitigation, pre-execution governance, webhook integrations, network isolation, and full audit logging — without changing a single line of OpenClaw code.

Why This Exists

OpenClaw is a powerful AI agent that can install and run third-party "skills" (JavaScript/TypeScript plugins). Running it on your infrastructure introduces real risks:

Risk	What could happen	How we stop it
Malicious skills	A skill runs dynamic code, spawns child processes, or exfiltrates data	AST-based scanner detects dangerous patterns before skills execute
Prompt injection	User input tricks the LLM into ignoring instructions	Regex sanitizer strips or rejects known injection patterns
Indirect injection	Tool results contain hidden instructions that hijack the agent	Plugin hook scans tool output before it enters agent context
Unauthorized access	Anyone on the network can use your OpenClaw instance	Bearer token auth on every request (constant-time comparison)
Data exfiltration	Skills phone home to attacker-controlled servers	DNS allowlisting blocks outbound traffic to non-approved domains
Uncontrolled tool execution	LLM executes dangerous tools without approval	Pre-execution governance with policy validation and human-in-the-loop approval
Webhook abuse	Attackers flood or spoof Telegram/WhatsApp endpoints	HMAC signature verification, replay protection, rate limiting, body-size limits
No audit trail	You can't tell what happened or when	Every security event logged to append-only JSON Lines

Architecture

                    ┌──────────────────────────────────────────────────────┐
                    │              Do