is openclaw safe enough for your accounts?

openclaw has a substantial public security history, so treat it as software that needs careful setup and upkeep, not something to give every account at once. as of 12 november 2026, its repository lists 722 published advisories. that is a historical count, not a count of flaws still present in your install. the useful question is which versions and permissions affect you.¹

by the dusk bot team · checked 12 november 2026 · how we made this

pixel art: a mint pixel bot, a pink pixel bot and a purple cat bot beside a tile saying OpenClaw, a shield with a tick and a magnifying glass, on a lemon field in front of white cliffs with a waterfall, one saying "check the version"

what the advisory numbers tell you

as of 12 november 2026, github lists 722 published security advisories: 14 critical, 249 high, 390 medium and 69 low. the first was published on 31 january 2026. the record includes a one-click remote code execution advisory involving authentication-token theft, along with gateway privilege-escalation and sandbox-escape advisories from february to april.¹

those are reasons to read the advisory for the version you run. they are not proof that every release is vulnerable to every issue. a published-advisory total alone cannot tell you whether your installation is patched, exposed or compromised. compare the affected versions and fixes with your actual install before connecting sensitive accounts.

the malicious skills audit is a separate problem

a vulnerability in the agent and a malicious add-on are different risks. koi security audited 2,857 clawhub skills and found 341 malicious ones, according to the hacker news report dated 2 february 2026. this was a particular audit, not a current measurement of the whole catalog.²

a skill can look useful while asking you to run something unrelated to its job. before adding one, read its instructions and any scripts it carries. avoid instructions that require unexplained commands or secrets. if you cannot tell what the package does, leave it out. popularity is not a substitute for understanding what you are installing.

give the security work its due

openclaw says it has added skill scanning with virustotal and nvidia, and had a trail of bits audit. those are meaningful responses to the earlier reports. they do not establish that every skill or configuration is safe.

read the current advisory details rather than treating an old headline as a verdict forever. open development makes reports visible; visibility helps you inspect the history, but does not replace updating your own system. if you need someone else to maintain the machine, compare the responsibilities in openclaw alternatives.

a smaller first job for any agent

start on a separate machine or in a workspace without your private files. connect one account, with reading access only if the task is a summary. leave payments, publishing and broad file access out of the trial. decide what a wrong action would cost before enabling it.

ask for a short explanation of the sources used and inspect the result yourself. then add only the access the next job needs. our computer-use safety guide goes through supervision and stopping a bot. a separate computer reduces what is in reach; it does not make a connected account harmless.

how to set a boundary in dusk bot

in dusk bot, Connected apps lets you choose access per bot: off, read only, or read and write. read-only restrictions are enforced before a call reaches the app.³ sending has a separate choice: Ask every time or Allow a daily amount. one exception: a bot on Full access with no sending rule of its own may send up to 25 a day without asking, so give full-access bots Ask every time under sending.⁴

other changes, like labels or page edits, may not ask first. keep the bot read-only or say "ask me before you change anything". only add trusted servers under Plugins, MCP servers; the mcp explainer describes that connection boundary. these settings shrink what can go wrong; they don't make any agent risk-free.

questions

is openclaw safe for non-technical users?

only take on the access and upkeep you understand. if advisory versions, permissions or add-on code are unfamiliar, start with a low-stakes reading task or get help before giving it important accounts.

does 722 advisories mean 722 open bugs?

no. it is the published repository advisory count on 12 november 2026. you need each advisory's affected-version and remediation details to assess an installation.¹

are all clawhub skills malicious?

koi's audit found 341 malicious skills among 2,857 examined. it does not say every skill is malicious, or establish today's catalog-wide rate.²

sources

openclaw repository security advisories, checked 12 november 2026
the hacker news: koi clawhub audit, checked 12 november 2026
dusk bot docs: connected apps
dusk bot docs: sending and approval settings

drafted with ai help from the dusk bot docs and the sources listed on this page, then checked against them. if something here is wrong or out of date, write to [email protected].