Run the free check

Weekly OpenClaw Security Checks for Clients: A DIY Routine (No Paid Tool Required)

Published 2026-10-19 · Updated 2026-10-19 · By The Is My Agent Safe team

Short answer

Checking a client install each week is a routine you run yourself: re-run openclaw security audit --deep, keep the client on the latest OpenClaw release, compare openclaw --version with published security advisories, and re-check that the Gateway is not reachable from outside. Save a dated JSON audit each time. The free paste check at /check can turn one audit into a plain-English fix list. Nothing we offer re-checks a client's install for you today.

  • Weekly: deep audit, version and update status, a quick exposure re-check.
  • Monthly: advisory review for the client's version, spend and key hygiene, kill-switch dry run.
  • Keep one audit JSON and one short notes file per client. Never put secrets in the notes.
  • Nothing we offer re-checks a client's install for you today. Solo version alerts are coming soon, and an agency preview is planned for early November. This routine is the deliverable.

What this routine covers

This guide is a DIY routine you can sell as monthly care. You run the checks yourself, with OpenClaw's own commands and published advisories. Nothing we offer re-checks a running agent for you.

Live today: the free paste check at /check and the $29 full report. Not live yet: Solo: version alerts (coming soon), and agency features, with a preview planned for early November. To hear when they ship, join the newsletter.

Weekly routine

Run these on the client's Gateway host, as the same user that runs OpenClaw.

  1. Re-run the deep audit and keep a copy.
openclaw security audit --deep --json > "audit-$(date +%Y%m%d).json"
openclaw security audit --deep

OpenClaw's docs recommend the audit after config changes and before exposing network surfaces. --deep adds best-effort live Gateway checks, security checks provided by installed plugins, and OpenClaw's pattern scans of installed skill and plugin code (CLI security, audit checks). Compare this week's JSON with last week's: new criticals, new warnings, suppressions that appeared.

  1. Check version and pending updates.
openclaw --version
openclaw update status
openclaw update --dry-run

Note the version on the care report. Keep the client on the latest release (2026.10.5 as of October 19, 2026). For context, 2026.8.1 is the floor for high-severity Gateway and CLI fixes. It fixed 48 advisories, 17 of them rated high, including CVE-2026-100552 (rated high): Codex-runtime tools could ignore a per-chat tool allowlist. See how to update without breaking it.

  1. Re-check exposure. Confirm gateway.bind is still what you agreed (usually loopback), and that no new public route appeared. From outside the host, re-test the public IP or domain the same way you did at handoff. Details: Is your agent exposed? and OpenClaw's exposure runbook.
  1. Paste one audit into the free check (optional). At /check, paste the audit output and openclaw --version for a red/amber/green fix order in plain English. It also checks for risky settings, such as API keys handed to skills, and checks the version against published security advisories. Look-only and point-in-time. It doesn't watch the install between visits or review skill code. Green means no issues found in the checks we ran.

Monthly routine

  1. Advisories. Skim OpenClaw's GitHub security advisories for anything that applies to the client's version. Record "reviewed, none apply" or the advisory IDs you acted on.
  2. Keys and spend. Confirm provider keys are still dedicated per client, not shared, and that spend limits or alerts are on. If a key may have leaked, follow API key leaked.
  3. Kill switch dry run. Once a month, prove you can stop the Gateway, set bind to loopback if it had been opened, and know where to rotate the Gateway token. OpenClaw's operator incident response is the source of truth.
  4. Send a short client note. Version, audit summary (critical / warn / info counts), changes since last month, open risks with owners. No secrets in the email.

What this routine isn't

Where next

Frequently asked questions

Does Is My Agent Safe check my clients' OpenClaw for me automatically today?

No. Nothing we offer re-checks a client's install for you today. The free check looks at one pasted audit and version, at the time you paste it. Solo ($9/month, coming soon) will re-check the last audit you pasted when a new release or advisory comes out, and email you if your version is affected. For agencies, a preview of an optional connector and an all-clients view is planned for early November. That is not a promise. Until then, run the routine below.

How often should I re-run openclaw security audit for a client?

OpenClaw's docs say to run it after any config change or before exposing network surfaces. For managed clients, also run openclaw security audit --deep on a fixed weekly cadence, and again after every upgrade, new skill, plugin or channel.

What should I store from each check?

A dated openclaw security audit --deep --json file, the openclaw --version string, and a short note of criticals fixed or accepted with reasons. Do not store Gateway tokens, API keys or full config dumps in the same place as the client report.

Can OpenClaw's heartbeat replace this routine?

No. Heartbeat is a scheduled agent turn for operator alerts. It is not a substitute for openclaw security audit, an outside exposure check or reading security advisories.

Sources

  1. OpenClaw docs: running the security audit
  2. OpenClaw docs: openclaw security (CLI)
  3. OpenClaw docs: security audit checks
  4. OpenClaw docs: openclaw update (CLI)
  5. OpenClaw docs: Gateway exposure runbook
  6. OpenClaw docs: network exposure
  7. OpenClaw docs: operator incident response
  8. OpenClaw docs: heartbeat
  9. OpenClaw GitHub security advisories
  10. OpenClaw release 2026.10.5
  11. OpenClaw release v2026.8.1
  12. GitHub advisory GHSA-wwcw-jfpp-gpxw (CVE-2026-100552)