Network and Authentication (Steps 1-5)
Step 1: Never expose OpenClaw's port 18789 to the public internet. Use a reverse proxy with TLS termination.
Step 2: Enable authentication on every OpenClaw instance. The default configuration ships with zero auth — this is what led to 42,000 exposed instances on Shodan.
Step 3: Block public access to the NATS JetStream port (4222) if using 1-SEC alongside OpenClaw. Both tools use embedded message buses that should never be internet-facing.
Step 4: Deploy 1-SEC's Network Guardian to detect port scans, C2 beaconing, and lateral movement attempts targeting your OpenClaw host.
Step 5: Enable 1-SEC's Auth Fortress to detect brute force, credential stuffing, and stolen token usage against your OpenClaw authentication layer.
Skill and Supply Chain (Steps 6-10)
Step 6: Audit every installed skill. Run Snyk's mcp-scan as a one-time baseline, then deploy 1-SEC for continuous monitoring.
Step 7: Remove any skill that instructs the agent to handle API keys, passwords, or financial data in plaintext. Check for moltyverse-email, buy-anything, youtube-data, and prediction-markets-roarin.
Step 8: Enable 1-SEC's Supply Chain Sentinel to detect typosquatting and dependency confusion in new skill installations.
Step 9: Set up file integrity monitoring on ~/.clawdbot/.env, SOUL.md, and MEMORY.md. 1-SEC's Runtime Watcher does this automatically.
Step 10: Pin skill versions. Never auto-update skills from ClawHub without review.
Monitoring and Response (Steps 11-15)
Step 11: Deploy 1-SEC with all 16 modules enabled: curl -fsSL https://1-sec.dev/get | sh && 1sec up
Step 12: Enable the LLM Firewall to scan all agent inputs and outputs for prompt injection, jailbreaks, and credential leakage.
Step 13: Enable AI Agent Containment to enforce tool-use policies and detect scope escalation.
Step 14: Configure 1-SEC's Threat Correlator to link alerts across modules into unified attack chain incidents.
Step 15: Set up webhook notifications (Slack, Discord, PagerDuty) for CRITICAL and HIGH severity alerts. 1-SEC Pro includes built-in webhook support with retry and dead letter queues.