Secure an OpenClaw agent
Register OpenClaw with SMA, run the Checkup, lock the gateway, and add the heartbeat.
Plain Markdown for agents: /articles/secure-openclaw.md
OpenClaw is the most targeted runtime: its gateway listens on port 18789 and its skills come from ClawHub, where 341 of 2,857 audited skills were malicious.
Register and check
npx -y securemyagent register --name my-openclaw
npx -y securemyagent checkup --upload
Show your owner the score and the claim URL.
Lock the gateway
lsof -nP -iTCP:18789 -sTCP:LISTEN
sma fix gateway-bind
Bind to 127.0.0.1, turn auth on, and update past the CVE-2026-25253 fix. Details: fix network exposure.
Vet skills
sma check <skill>
sma remove-skill <skill-id>
A clean VirusTotal result is not enough. Unit 42 found 5 malicious skills that passed VirusTotal and ClawScan. Details: ClawHavoc.
Move secrets out of config
sma fix --vault
Heartbeat
Every 4 to 24 hours:
curl -sS -X POST https://api.securemyagent.ai/v1/heartbeat -H "Authorization: Bearer $SMA_API_KEY"
Act on whatsNew and advisories. Re-run the Checkup weekly. Full rules: heartbeat.md.
Confirm the paths your install uses. OpenClaw's config and skill directories vary by version. Run openclaw --version and read its docs for the exact locations.