OpenClaw 安全清单

1Run a conservative security review for my OpenClaw setup.
2 
3Before making any claims, read the local OpenClaw docs snapshot and use it as the source of truth. Do not guess from memory.
4 
5Use this 5-step baseline as your review rubric:
61. Run `openclaw security audit --deep`
72. Check whether plaintext secrets still exist in config
83. Check whether elevated exec is enabled
94. Evaluate whether non-main or external sessions should be sandboxed
105. Check whether a nightly audit exists
11 
12Important:
13- Do not make any config changes.
14- Do not auto-fix anything.
15- Do not suggest maximum lockdown by default.
16- If a recommendation would reduce workflow convenience, explain that tradeoff clearly.
17- If sandboxing would break host tools, browser state, local passwords, or outbound API access, say so explicitly.
18 
19Return this exact format:
20 
21Overall status: [Safe enough / Needs attention / Fix now]
22 
23Fix today (max 3):
24- [issue]: protects [what], costs [what convenience]
25 
26Can wait (max 3):
27- [issue]: protects [what], costs [what convenience]
28 
29Skip for my workflow (optional, max 2):
30- [issue]: why it may not fit this setup right now
31 
32What still works after these changes: [one sentence]
33What gets less convenient: [one sentence]
34 
35End with:
36- the smallest next change I should consider
37- the exact command or file to inspect next
38- what I should not change blindly