How to Audit a Client's OpenClaw: A Step-by-Step Handoff Checklist

Q: What commands should I run on every client audit?

`openclaw doctor`, `openclaw security audit --deep` (save `--json`), `openclaw --version`, `openclaw health`, and an outside reachability test of the Gateway port or URL. Add `openclaw update --dry-run` when you will recommend an upgrade.

Q: Can I paste the client's audit into Is My Agent Safe?

Yes. The free check at /check accepts a pasted `openclaw security audit --deep` output and version. It explains the findings, checks for risky settings and checks the version against published security advisories. It is look-only and point-in-time, and it doesn't review skill code. Use it as a plain-English companion to your own notes, not as a replacement for the CLI on the host.

Published 2026-10-19 · Updated 2026-10-19 · By The Is My Agent Safe team

Short answer

Inventory the host, bind, channels and credentials first. Run openclaw doctor and openclaw security audit --deep, fixing criticals in OpenClaw's published order. Update to the latest release (2026.10.5 as of October 19, 2026), prove the Gateway matches an agreed private access pattern, rotate into client-owned keys with spend caps, dry-run the kill switch, and leave a dated audit JSON plus a secret-free acceptance note.

Inventory before you change anything (exposure runbook pre-flight).
Deep audit, then criticals first: open+tools, public exposure, browser control, permissions, plugins.
Latest release, private access pattern, dedicated keys, spend caps, kill switch.
Handoff pack: dated audit JSON, version, exceptions with owners, stop steps. No secrets in the PDF.

Before you start

Work on the client's host (or jump host) with approval in writing. Prefer a separate Gateway per client; OpenClaw is not a hostile multi-tenant boundary (trust model).

This is the one-off handoff audit. For the recurring version, see Weekly OpenClaw security checks for clients. This page is the handoff checklist.

Step 1: Inventory (do not change config yet)

Copy the exposure runbook's pre-flight list into your notes:

Host, OS user, state directory (default ~/.openclaw)
Gateway URL, gateway.bind, port (default 18789)
Auth mode (token / password / trusted proxy)
Every enabled channel and whether DMs, groups or webhooks are open
Agents reachable from non-local senders
Tool profile, sandbox and elevated tools per reachable agent
External credentials those agents can use
Backup location for config and credentials

Step 2: Baseline commands

openclaw doctor
openclaw security audit
openclaw security audit --deep
openclaw security audit --deep --json > "client-audit-$(date +%Y%m%d).json"
openclaw --version
openclaw health

Read the deep audit before using --fix. --fix only flips some open group policies to allowlists and tightens permissions; it does not rotate secrets or change bind (CLI security).

Plain-English reading of checkIds: openclaw security audit explained. Suspected false alarms: audit false alarms.

Step 3: Fix in OpenClaw's order

From running the audit:

Open DMs/groups with tools enabled → pairing or allowlists, then tighten tools/sandbox.
Public network exposure (LAN bind, Funnel, missing auth) → fix immediately.
Remote browser control → treat like operator access.
Permissions on state/config/credentials.
Plugins → load only what you explicitly trust.

Criticals before warnings. Change one thing, re-run --deep, repeat.

Step 4: Update to the latest release

openclaw --version
openclaw update --dry-run

Hand off on the latest release (2026.10.5 as of October 19, 2026). For context, 2026.8.1 is the floor for high-severity Gateway and CLI fixes. It fixed 48 advisories, 17 of them rated high, including CVE-2026-100552 (rated high): Codex-runtime tools could ignore a per-chat tool allowlist. Older installs also miss the fix for CVE-2026-25253 (Gateway token theft via a crafted link; fixed earlier, in 2026.1.29 per NVD). Upgrade path: update without breaking it.

Step 5: Prove exposure matches the design

On the host, confirm what listens on 18789. From another network, test the public IP or hostname. Any unexpected answer means it is reachable.

Agree one pattern from the exposure runbook, usually loopback + SSH tunnel or Tailscale Serve. Walkthrough: check if exposed and VPS guide.

Step 6: Keys, spend, ownership

List every provider and channel credential the agent can use.
Move ownership to the client's accounts (or their vault), not your personal keys.
Rotate at handoff: new Gateway token (openclaw doctor --generate-gateway-token), new provider keys, update the secret store or config, restart.
Set hard spend limits or equivalent alerts at each provider.
If anything may already have leaked: API key leaked.

Never paste live secrets into the handoff PDF or ticket.

Step 7: Kill switch dry run

With the client watching (or on a recording they keep):

openclaw gateway stop
Confirm messaging and tools stop.
Show how to set gateway.bind back to loopback if it was opened.
Show where to rotate the Gateway token and provider keys.
openclaw gateway start only after they agree the stop worked.

Source sequence: operator incident response.

Step 8: Handoff pack (acceptance)

Leave the client:

Dated security audit --deep --json and the version string
List of criticals/warnings fixed, and any accepted findings with checkId, reason and owner
Access pattern (bind, tunnel/Tailscale, who holds the token)
Kill-switch steps in their wiki
Next care date (or point them at the weekly check routine)

Optional: paste the final audit and version into /check. If you buy the $29 full report, you can attach it to the pack. Say clearly it is a point-in-time reading. Green means no issues found in the checks we ran.

Where next

Frequently asked questions

What commands should I run on every client audit?

openclaw doctor, openclaw security audit --deep (save --json), openclaw --version, openclaw health, and an outside reachability test of the Gateway port or URL. Add openclaw update --dry-run when you will recommend an upgrade.

In what order should I fix audit findings?

OpenClaw's docs: (1) open messaging with tools enabled, (2) public network exposure, (3) remote browser control, (4) file permissions, (5) plugins. Criticals before warnings inside each step.

When is the install ready to hand off?

When criticals are gone or accepted in writing, the Gateway matches an agreed private access pattern, keys are client-owned with spend limits, the client can perform the kill switch, and you have stored a dated audit JSON they can re-run against.

Can I paste the client's audit into Is My Agent Safe?

Yes. The free check at /check accepts a pasted openclaw security audit --deep output and version. It explains the findings, checks for risky settings and checks the version against published security advisories. It is look-only and point-in-time, and it doesn't review skill code. Use it as a plain-English companion to your own notes, not as a replacement for the CLI on the host.

How to Audit a Client's OpenClaw: A Step-by-Step Handoff Checklist

Before you start

Step 1: Inventory (do not change config yet)

Step 2: Baseline commands

Step 3: Fix in OpenClaw's order

Step 4: Update to the latest release

Step 5: Prove exposure matches the design

Step 6: Keys, spend, ownership

Step 7: Kill switch dry run

Step 8: Handoff pack (acceptance)

Where next

Frequently asked questions

Sources

Get the weekly plain-English agent security brief