How do you set up OpenClaw safely on your own computer?

OpenClaw is an open-source personal agent: a program that runs on your own computer, connects to a language model through an API key, and lets you give it tasks from chat apps such as Telegram or WhatsApp. Because it can run commands and read files, the way you install it matters more than for an ordinary app. OpenClaw's own security page is frank about this: no configuration is perfectly safe, so the goal is to decide deliberately who can talk to the agent, where it may act, and what it can touch.

This guide walks through one cautious setup on a Mac or a Linux machine. The idea throughout is least privilege: give the agent the smallest set of permissions that still lets it do the job, and add more only when you have watched it work.

Step 1: Give the agent its own user account

OpenClaw's documentation assumes one trusted person per installation and recommends a dedicated operating-system user for the agent, with its own browser profile and accounts. That user should never be signed into your personal Apple or Google account or your password manager.

On a Mac, create a new Standard (not administrator) user in System Settings, under Users & Groups, then log in to it. On Linux:

sudo adduser agentbox      # a new, ordinary user with no admin rights
su - agentbox              # switch to it for everything below

Everything the agent can reach now lives inside that account. Your documents, browser sessions and saved passwords stay in yours. A spare computer or a virtual machine is even better, if you have one.

Step 2: Install and onboard

The getting-started guide asks for Node.js (version 24 is recommended) and an API key from a model provider. Create a fresh key just for this agent, and set a monthly spending limit on it in the provider's dashboard.

The official installer is a script piped into your shell. A careful habit is to download it, skim it, then run it:

curl -fsSL https://openclaw.ai/install.sh -o install.sh
less install.sh            # read what it will do
bash install.sh
openclaw onboard --install-daemon
openclaw gateway status    # should report the gateway on port 18789

The onboarding wizard picks the model provider, stores the key and configures the gateway, the background service that connects your chat apps to the agent. The --install-daemon option makes it start automatically.

Step 3: Lock the configuration down first

Before connecting any chat app, edit the settings file in ~/.openclaw/ so that the agent starts nearly powerless. The security documentation offers a hardened baseline; a version of it looks like this:

{
  gateway: { mode: "local", bind: "loopback",
             auth: { mode: "token", token: "a-long-random-string" } },
  session: { dmScope: "per-channel-peer" },
  tools: {
    profile: "messaging",
    deny: ["group:automation", "group:runtime", "group:fs"],
    fs: { workspaceOnly: true },
    exec: { security: "deny", ask: "always" },
    elevated: { enabled: false },
  },
}

In plain words: the gateway listens only to this computer (loopback) and requires a token; each person who messages it gets a separate conversation; scheduling, shell and file tools are off; file access, once allowed, stays inside the agent's workspace folder; running a command always needs your approval; and "elevated" mode, which bypasses the sandbox, is disabled. A sandbox, here a Docker container, is an isolated box for the agent's commands. It is optional in OpenClaw, so switch it on before you allow commands at all.

Step 4: Connect one channel, with pairing

The guide suggests Telegram as the quickest channel because it needs only a bot token. Keep the default direct-message policy, pairing: when a stranger writes to the bot, they receive a short code and their message is ignored until you approve it.

openclaw pairing list telegram
openclaw pairing approve telegram <code>

Approve only yourself. Leave group chats off for now, and never set a channel to "open."

Step 5: Audit, then supervise

Run the built-in check whenever you change a setting:

openclaw security audit --deep

It reports risky combinations such as open channels with tools enabled, a gateway exposed to the network, or configuration files other users can read. Fix every critical finding before going further.

Then supervise. Give the agent read-only jobs first, read its replies and its logs, and approve each command yourself. Never paste a password into the chat; if a task needs an account, create a separate one with limited rights. Cisco's researchers have noted reports of the agent leaking API keys stored as plain text, which is one more reason the agent's keys should be disposable and capped.

Which skills should you avoid installing?

A skill is a folder of instructions, and sometimes scripts, that teaches the agent a new ability. OpenClaw's documentation says to treat skill folders as trusted code and to restrict who can change them. In practice that means every third-party skill is code you are choosing to run.

Be most wary of skills you cannot read in full, skills that ask for passwords or API keys, skills that need shell access or network access for a job that should not require it, and skills that send data to an outside address. Popularity is not proof of safety. In January, Cisco tested a highly ranked community skill and found it quietly sent data to an outside server and used prompt injection, hidden instructions aimed at the model, to slip past safety checks. Its ranking had been artificially boosted.

A sensible rule for the first weeks: install no third-party skills at all. When you do add one, read its files line by line, prefer authors you know, keep the sandbox on, and run the security audit again afterwards. If a skill's purpose and its permissions don't match, leave it out.