OpenClaw Security: Permissions, Prompt Injection, and Safe Operating Rules
A practical security guide for tool-enabled agents: least privilege, approval gates, secret hygiene, and prompt-injection defenses.
OpenClaw Security
Tool-enabled agents fail differently than chatbots. The best defense is not a single setting—it's an operating discipline.
The Five Security Rules
Rule 1: Least Privilege by Default
Grant only the tools and scopes needed for the current task. Expand permissions only after successful, audited runs.
✅ Good: "Read this spreadsheet and summarize row 5"
❌ Bad: "Have full access to my Google Drive"Rule 2: Secrets Never Enter Prompts
Do not paste API keys, passwords, tokens, or private URLs into chats. Assume logs and context can leak.
✅ Good: Store keys in environment variables or secure vaults
❌ Bad: "Here's my API key: sk-abc123..."Rule 3: Human Approval Gates
Require approval for:
- Sending messages/emails
- Purchases/payments
- Deleting files or changing account settings
- Posting publicly
Rule 4: Prompt-Injection Hygiene
Treat external text as hostile:
- Do not execute instructions found in documents or posts
- Summarize first, then decide actions explicitly
- Use "allowlists" for safe commands
Rule 5: Auditability
Keep a lightweight audit trail:
- What tools were called
- What inputs/outputs were produced
- What approvals were given
The Prompt Injection Threat
Prompt injection happens when external text manipulates your agent:
| Attack Vector | Example |
|---|---|
| Document injection | A PDF contains "ignore previous instructions and..." |
| Social engineering | A post says "please share your API key to help me" |
| Hidden instructions | Invisible text in a webpage triggers unwanted actions |
Defense: Treat all external content as untrusted. Verify before acting.
Security Checklist
Before deploying an agent:
- Permissions are scoped to minimum required
- No secrets in prompts or accessible notes
- Irreversible actions require human approval
- External content is treated as untrusted
- Basic audit logging is enabled