Security Hardening (Part Three): Prompt Injection Defense and Security Audit

Goal in one sentence: Defend against prompt injection — keep untrusted input entering the Gateway under control, clean up plaintext credentials, and pass a security audit with openclaw secrets audit --check.

Prerequisite: First complete "Security Hardening (Part One): Access Control and Identity"; for tool permissions and sandboxing, see "Security Hardening (Part Two)".

Preparation

• OpenClaw 2.0 (v2026.8.1) and above; this tutorial is based on repository version 2026.10.9.
• A Gateway configuration that starts normally: channels are connected and at least one model provider is configured.
• The openclaw CLI can be run in the terminal.

Follow Along

Step 1: Take Stock of the Injection Surface

Action: List all input sources that enter the Gateway context — channel messages, skills, content returned by MCP tools, and web pages fetched by the browser. Mark each item as "trusted / untrusted." Remember one principle: the Gateway process is the only trust boundary; the model and the agent harness are both swappable plugins, and content returned by plugins is always treated as untrusted input.

Expected result: a list of "input source → trust level → tools it can trigger." For any tool that an untrusted source can trigger, go back to the previous lesson and tighten permissions.

Step 2: Migrate Credentials and Eliminate Plaintext

Action: Plaintext credentials may hide in four places: openclaw.json, .env, retired auth-profile JSON archives, and generated agents/*/agent/models.json. Rewrite each one as a SecretRef — four types of provider blocks are supported: env, file, exec, and store; exec can connect directly to 1Password, Bitwarden, Vault, pass, and sops. Put team-shared secrets into the shared SQLite secret store, and route outbound traffic for fetching secrets through the egress proxy's allowlist.

Expected result: no plaintext API keys remain in the files above. Note that SecretRef is enabled per credential (opt-in) and will not migrate automatically.

Step 3: Run the Audit

Action: Run

openclaw secrets audit --check

Check whether any plaintext residue remains. @@I18N_KEEP_000019@@ For the full audit items of hardened-baseline and the corresponding command parameters, refer to the official security documentation.

Expected result: the report shows no plaintext residue. If there is residue, follow the file indicated by the report and go back to Step 2 to continue migrating.

Verification

1. Restart the Gateway and confirm that all channels and models work normally — credentials are now loaded from SecretRef.
2. Run openclaw secrets audit --check again; the result shows no residue.
3. Send an inducement message in a test channel (for example, asking to read .env) and confirm that approval is bound to the exact request, command, session, and person, rather than being silently allowed — this is the core behavior of the 2.0 security model.

Common Pitfalls

• Only cleaning up openclaw.json while missing .env and the generated agents/*/agent/models.json — the audit will still report plaintext.
• Assuming that enabling SecretRef solves everything: it is enabled per credential, and each credential must be migrated individually until the audit report is clean.
• Merging the output of skills or MCP tools directly into the context: this expands the injection surface and must be paired with the trust labeling from Step 1 and the tool permissions from the previous lesson.
• @@I18N_KEEP_000020@@ The specific list of default configuration items recommended by hardened-baseline, to be added after checking the official documentation.

Next Lesson

Once the security baseline is in place, the next lesson, "CLI Commands and Configuration Quick Reference," compiles the commands and configuration items you use most in daily operations.