openclaw-hardener

name	openclaw-hardener
description	OpenClaw self-check & auto-hardening skill. Audits your instance for the exact vulnerabilities tracked by declawed.io (CVE-2026-25253, exposed panels, default credentials, Docker escapes). Fixes what it finds.
version	1.0.0
author	2233admin
license	MIT
tags	["security","hardening","self-check","declawed"]
allowed-tools	Bash Read Edit Write Grep Glob

OpenClaw Hardener - Self-Check & Auto-Fix

Inspired by declawed.io tracking 230,000+ exposed OpenClaw instances worldwide. Don't be one of them.

When to Use

• After fresh OpenClaw deployment
• Periodic security self-check (recommended: weekly)
• Before exposing any service to the internet
• After config changes

Audit Checklist

When invoked, systematically check ALL of the following. For each finding, report severity and offer to auto-fix.

1. Network Exposure Audit

Check if OpenClaw is bound to 0.0.0.0 (all interfaces) by inspecting config.yaml server.host field and verifying with ss -tlnp filtering for ports 18789, 8080, 8081.

Severity: CRITICAL if bound to 0.0.0.0 on a public-facing server.

Auto-fix: Change host: 0.0.0.0 to host: 127.0.0.1 (or WireGuard interface IP like 10.10.0.x) in config.yaml, then restart the service.

2. Authentication Audit

Check the auth.password field in config.yaml.

Severity: CRITICAL if password: is empty or missing.

Auto-fix: Generate a strong random password with openssl rand -base64 24, update the config, and inform the user of the new password.

3. Favicon Fingerprint Check (declawed.io detection)

declawed.io scans the entire internet for these favicon MD5 hashes:

• Primary favicon.ico: f58854f6450618729679ad33622bebaf (28,728 matches globally)
• SVG variant: 75661cbf8fd50009be0c46a9ca8b3180 (9,707 matches)

Fetch http://localhost:18789/favicon.ico and compute its MD5. If it matches AND the instance is publicly accessible, it is already in declawed.io's database.

Severity: HIGH if favicon matches known fingerprints AND instance is publicly accessible.

Auto-fix options:

1. Block public access (preferred - see Network Exposure)
2. Replace favicon with a custom one to avoid fingerprinting
3. Add reverse proxy with custom headers

4. CVE-2026-25253 - Gateway URL Auth Bypass (CVSS 9.8)

The gatewayUrl query parameter can override the saved gateway and auto-connects, sending the auth token to an attacker-controlled endpoint. This enables remote code execution.

Test by checking if the application accepts a gatewayUrl parameter without validation.

Severity: CRITICAL

Auto-fix: Update OpenClaw to latest patched version. If unavailable, add reverse proxy rule to strip or reject requests containing gatewayUrl parameter.

5. Docker Socket Exposure

Check if the OpenClaw container has /var/run/docker.sock mounted by inspecting docker-compose.yml or running container mounts.

Severity: CRITICAL if Docker socket is mounted - enables container escape to host.

Auto-fix: Remove Docker socket mount. Use Docker API over TCP with TLS mutual auth if Docker access is genuinely needed.

6. API Key Exposure

Scan config.yaml for plaintext API keys (patterns like sk-, api_key: with values). Also check if frontend JS bundles serve any embedded keys by fetching the main page HTML and linked JS assets.

Severity: HIGH if API keys found in config files or client-side code.

Auto-fix: Move keys to environment variables. Replace api_key: sk-xxxx with api_key: ${OPENAI_API_KEY} in config, then set the env var.

7. MCP Server Exposure

Check the mcp: section in config.yaml for enabled: true combined with host: 0.0.0.0.

Severity: HIGH if MCP is enabled AND bound to all interfaces.

Auto-fix: Either disable MCP (enabled: false) or bind to localhost/WireGuard only.

8. SSH Command Injection (CVE-2026-25157, CVSS 7.8)

Check if running on macOS (uname -s returns Darwin) with SSH-related skills installed.

Severity: HIGH on macOS systems with SSH skills enabled.

Auto-fix: Update to patched version. Review and sanitize all SSH command inputs in skill definitions.

9. Bot/Messaging Channel Audit

Check the robots: section in config.yaml for any enabled bots (wecom, dingtalk, lark with enabled: true).

Severity: MEDIUM if bots enabled on a publicly exposed instance - attacker gains messaging channel access.

Auto-fix: Disable bots on exposed instances, or ensure instance is not publicly accessible first.

10. Process Privilege Audit

Check what user the OpenClaw process runs as with whoami and ps aux.

Severity: HIGH if running as root.

Auto-fix: Create dedicated user openclaw, chown files, update systemd service to User=openclaw.

11. Firewall Rules Audit

Check iptables (both raw PREROUTING and INPUT chains) for rules restricting access to OpenClaw ports (18789, 8080, 8081).

Severity: HIGH if no firewall rules restrict access to OpenClaw ports on a public server.

Auto-fix: Create an OPENCLAW_BLOCK chain in the raw table that allows only trusted CIDRs (e.g., WireGuard 10.10.0.0/24 and localhost 127.0.0.0/8), drops everything else. Apply to all OpenClaw ports. Persist with iptables-save.

12. Malicious Skills Detection (ClawHavoc Campaign)

The ClawHavoc campaign (Jan-Feb 2026) distributed 335+ malicious skills via ClawHub, delivering NovaStealer and AMOS info-stealers.

Scan all installed skills for suspicious patterns:

• Reverse shell commands (nc -e, bash -i, etc.)
• Base64-encoded payloads
• Downloads of external scripts (.sh, .py, .exe)
• Eval/exec calls with dynamic input
• Obfuscated code

Severity: CRITICAL if suspicious patterns found.

Auto-fix: Quarantine suspicious skills to a quarantined/ directory, generate a report for manual review.

Report Format

After running all checks, output a summary table:

========================================
  OpenClaw Hardener Audit Report
========================================

Instance: localhost:18789
Date: YYYY-MM-DD HH:MM UTC
Score: XX/100

| # | Check                    | Status | Severity |
|---|--------------------------|--------|----------|
| 1 | Network Exposure         | PASS/FAIL | -/CRIT |
| 2 | Authentication           | PASS/FAIL | -/CRIT |
| 3 | Favicon Fingerprint      | PASS/FAIL | -/HIGH |
| 4 | CVE-2026-25253 Gateway   | PASS/FAIL | -/CRIT |
| 5 | Docker Socket            | PASS/FAIL | -/CRIT |
| 6 | API Key Exposure         | PASS/FAIL | -/HIGH |
| 7 | MCP Exposure             | PASS/FAIL | -/HIGH |
| 8 | SSH Injection            | PASS/FAIL | -/HIGH |
| 9 | Bot Channel Security     | PASS/FAIL | -/MED  |
|10 | Process Privilege        | PASS/FAIL | -/HIGH |
|11 | Firewall Rules           | PASS/FAIL | -/HIGH |
|12 | Malicious Skills         | PASS/FAIL | -/CRIT |

CRITICAL: X issues  HIGH: X issues  MEDIUM: X issues

[Auto-fix available for X issues. Apply? (y/n)]
========================================

Scoring

• Start at 100 points
• CRITICAL finding: -15 points each
• HIGH finding: -10 points each
• MEDIUM finding: -5 points each
• Score < 50: Grade F (Immediate action required)
• Score 50-70: Grade D (Significant risk)
• Score 70-85: Grade C (Needs improvement)
• Score 85-95: Grade B (Acceptable)
• Score 95-100: Grade A (Hardened)

Auto-Fix Mode

When the user confirms auto-fix, apply all available fixes in order:

1. Firewall rules (immediate protection)
2. Bind address change (requires restart)
3. Password setting (requires restart)
4. API key migration to env vars
5. MCP disable/rebind
6. Bot disable on exposed instances
7. Process privilege downgrade
8. Malicious skill quarantine

After applying fixes, re-run the audit to verify improvements. Show before/after score comparison.

References

• declawed.io - Live threat intelligence dashboard tracking 230K+ exposed instances
• CVE-2026-25253 - Gateway auth bypass (CVSS 9.8)
• CVE-2026-24763 - Docker sandbox escape (CVSS 8.8)
• CVE-2026-25157 - SSH command injection (CVSS 7.8)
• ClawHavoc Campaign - 335+ malicious skills distributing NovaStealer/AMOS info-stealers