Advanced Handbook: Skills and Security Hardening

💡 Goal: After about 50–100 minutes, your Claw will have a new Skill installed, and you will have run a openclaw security audit security checkup—OpenClaw handling the two advanced topics of "capability" and "security" in one go.

🎯 Stage Goals

After completing this stage, you can verify these three things:

1. Can install: Use openclaw skills install to install a third-party Skill and successfully invoke it in chat with /skill <name>.
2. Can write: Hand-write a minimal SKILL.md with only name and description as the two required fields, and see it loaded with openclaw skills list.
3. Can defend: Run openclaw security audit through, tighten DM policies and tool permissions according to the official hardening baseline, and understand every check result.

⏳ Estimated Time

This stage has 6 lessons in total, with lesson durations adding up to 75 minutes; allowing a ±30% margin, the whole stage takes about 50–100 minutes.

The longest lesson is "Write Your Own Skill" (15 minutes); all the other lessons are 12 minutes each.

🚀 Before You Start

• CompletedDaily Use: Working Efficiently with Your Claw: The Gateway is already running as a background service, and you chat with Claw every day.
• Terminal available: This stage involves running quite a few openclaw commands; Skill installation and the security audit are both done on the command line.
• If you want to follow along with the sandbox part, install Docker on your machine first—it is the default sandbox backend.
• The "Write Your Own Skill" lesson takes a programmer's perspective; if you don't write code, you can skip it for now.
• A glass of water. There's a lot of command-line work this time—sip while you type.

This stage only covers Skills and security hardening; automation, browsers, and MCP are covered in the Efficient Workflows stage, so make sure you're looking in the right place.

📚 Lessons in This Stage

Lesson	Content	Duration
Getting Started with Skills: Installation, Usage, and Configuration	Search, install, and verify third-party Skills; /skill invocation and skills configuration	12 minutes
Write Your Own Skill: SKILL.md and ClawHub Publishing	Hand-write a minimal SKILL.md, frontmatter fields and ClawHub publishing	15 minutes
Skill Workshop: Letting Claw Learn Skills on Its Own	/learn automatic learning, off/propose/auto three modes, and version rollback	12 minutes
Security Hardening (Part One): Access Control and Identity	dmPolicy four levels, pairing approval, and allowlists	12 minutes
Security Hardening (Part Two): Tool Permissions and Sandbox	exec permissions in five levels, session permissions in four levels, and three groups of sandbox settings	12 minutes
Security Hardening (Part Three): Prompt Injection Defense and Security Audit	Prompt injection defense, openclaw security audit and hardening baseline	12 minutes

🎒 What You Will Gain

• A complete set of Skill management techniques: searching, installing, verifying, and updating all done via the openclaw skills command family, plus remembering the official advice—treat third-party skills as untrusted code and read them through before enabling.
• The ability to turn repetitive workflows into homemade Skills, and to let Claw learn skills on its own with /learn.
• A practical security baseline: DM policies, tool permissions, sandbox, and hardening baselines, plus knowing which dangerouslyAllow* flags must never be touched.
• Take your new capabilities to Scenario Practice and pick a route to practice—OpenClaw advanced configuration is only truly put to use then.

---

Ready? Start the first lesson →—OpenClaw going advanced starts with installing your first Skill.