The OpenClaw
Security Guide

1. What Cisco's Security Team Actually Found

Cisco's security researchers discovered that a malicious OpenClaw skill can exfiltrate your data silently — without triggering any alert, warning, or visible action on screen. The attack vector is the skill system itself: because skills run with the same permissions as OpenClaw, a compromised or malicious skill inherits full access to everything OpenClaw can touch.

That means your inbox, your calendar, your local files — all of it can be read and sent externally without you knowing. The agent takes action quietly. That's the whole point of it, and also the risk.

2. What Data Is Actually Exposed

If OpenClaw is connected to your Gmail, it can read every email in your inbox — including client conversations, quote requests, signed contracts, and invoices with bank details. If it's connected to your calendar, it knows your schedule, your client meetings, and the notes attached to them.

This isn't just your data. If a client sent you their job spec, their address, or their payment details over email — that's their data now sitting inside a system that can be compromised through a single bad skill install.

3. How to Audit Your Installed Skills Right Now

4. Safe Configuration Checklist

5. How to Isolate OpenClaw from Sensitive Client Data

The simplest protection is isolation. Give OpenClaw a sandboxed environment — a dedicated email address, a separate calendar, and a specific folder on your machine — and keep your actual client work outside of it.

Think of it like a work phone: useful for certain tasks, but you wouldn't put your clients' bank details on it. Same principle here.

If you want the full benefit of AI automation without the security surface area, that's exactly what a properly built custom automation gives you — scoped access, no skill marketplace risk, deployed to infrastructure you control.