Openclaw Multibot Audit

OpenClaw Multi-Bot Security Audit

Audit any OpenClaw Telegram bot for multi-tenant security issues. Based on real production incidents from deploying CanArt Bot and TreeArt Bot.

When to Use

• Before launching a public OpenClaw Telegram bot
• After adding multi-user support to an existing bot
• During security review of any OpenClaw gateway serving multiple users
• When you suspect cross-user data leakage

Critical Context: OpenClaw's Security Model

From official docs (https://docs.openclaw.ai/gateway/security):

"OpenClaw is NOT a hostile multi-tenant security boundary for multiple adversarial users sharing one agent/gateway."

"If you need mixed-trust or adversarial-user operation, split trust boundaries (separate gateway + credentials, ideally separate OS users/hosts)."

Any public Telegram bot (dmPolicy: "open", allowFrom: ["*"]) IS a mixed-trust scenario. Plan accordingly.

Audit Checklist

Run through each item. Mark as PASS, FAIL, or N/A.

1. Session Isolation

File: config/openclaw.json

[ ] session.dmScope is "per-channel-peer" (or "per-account-channel-peer")
    WITHOUT THIS: All users share the same conversation context.
    Alice's private messages leak to Bob.

// CORRECT
"session": { "dmScope": "per-channel-peer" }

// WRONG (or missing)
"session": {}

2. Filesystem Tool Isolation

File: provision-user.sh or openclaw.json

[ ] tools.fs.workspaceOnly is true for each user agent
    WITHOUT THIS: Agent can read/write/edit ANY file on the system.
    User A can read /workspaces/B/USER.md via filesystem tools.

Per-agent config (set in provision-user.sh):

agent_entry["tools"] = {"fs": {"workspaceOnly": True}}
agent_entry["tools"]["exec"] = {"applyPatch": {"workspaceOnly": True}}

IMPORTANT: workspaceOnly only blocks read/write/edit/apply_patch. It does NOT block exec shell commands. An agent can still exec cat /workspaces/other_user/.

3. Exec Isolation (The Hard Problem)

[ ] sandbox.mode is "all" with scope "agent" or "session"
    WITHOUT THIS: exec commands run on the host with full filesystem access.
    This is the ONLY way to truly prevent shell-based cross-user access.

// Full container isolation (resource heavy — Docker container per agent)
{
  "agents": {
    "list": [{
      "id": "user-123",
      "workspace": "/workspaces/123",
      "sandbox": {
        "mode": "all",
        "scope": "agent",
        "workspaceAccess": "rw"
      }
    }]
  }
}

Trade-off: Container per agent = ~50-100MB RAM per user. For <50 users, acceptable. For 500+, expensive.

Practical alternative (if no sandbox): Accept the gap, rely on SOUL.md + message-guard hook, document the limitation.

4. Auth Profiles Separation

Files: provision-user.sh, entrypoint.sh

[ ] provision-user.sh copies auth-profiles.json from main agent to user agent
[ ] entrypoint.sh re-copies auth-profiles.json on container restart
    WITHOUT THIS: User agents can't send messages after restart. Silent failure.

# In provision-user.sh (after openclaw agents add):
MAIN_AUTH="/root/.openclaw-PROFILE/agents/main/agent/auth-profiles.json"
AGENT_AUTH_DIR="/root/.openclaw-PROFILE/agents/user-${UID}/agent"
mkdir -p "${AGENT_AUTH_DIR}"
cp "${MAIN_AUTH}" "${AGENT_AUTH_DIR}/auth-profiles.json"

# In entrypoint.sh (after agent re-registration loop):
for uid_dir in /workspaces/[0-9]*; do
    uid=$(basename "$uid_dir")
    agent_auth_dir="/root/.openclaw-PROFILE/agents/user-${uid}/agent"
    if [ ! -f "${agent_auth_dir}/auth-profiles.json" ]; then
        mkdir -p "${agent_auth_dir}"
        cp "${MAIN_AUTH}" "${agent_auth_dir}/auth-profiles.json"
    fi
done

5. Config Preservation on Restart

File: entrypoint.sh

[ ] workspaceOnly setting is RE-APPLIED after entrypoint re-registers agents
    WITHOUT THIS: openclaw agents add may overwrite tool config, losing isolation.

After the binding restoration Python block, re-apply:

for uid, info in reg.get("users", {}).items():
    aid = info.get("agent_id", f"user-{uid}")
    for entry in config.get("agents", {}).get("list", []):
        if entry.get("id") == aid:
            entry.setdefault("tools", {})
            entry["tools"]["fs"] = {"workspaceOnly": True}
            entry["tools"].setdefault("exec", {})["applyPatch"] = {"workspaceOnly": True}
            break

6. User ID Validation

File: provision-user.sh

[ ] Telegram user ID validated as numeric-only
    WITHOUT THIS: Path traversal via user_id=../../etc/passwd

if ! [[ "${TELEGRAM_USER_ID}" =~ ^[0-9]+$ ]]; then
    echo "ERROR: TELEGRAM_USER_ID must be numeric" >&2
    exit 1
fi

7. Workspace Directory Permissions

File: provision-user.sh

[ ] User workspace created with chmod 700
    WITHOUT THIS: Other processes in the container could read user data.

mkdir -p "${USER_DIR}"/{memory,output,data}
chmod 700 "${USER_DIR}"

8. Provisioning Concurrency

File: provision-user.sh

[ ] flock used to prevent concurrent provisioning races
[ ] Idempotent check (skip if already provisioned)
    WITHOUT THIS: Two messages from same user could create corrupt workspace.

exec 200>/tmp/provision.lock
flock -n 200 || { echo "ERROR: Another provisioning in progress"; exit 1; }

9. Error Leaking Prevention

Files: Scripts (generate.py, etc.), AGENTS.md template

[ ] Scripts catch ALL exceptions and output safe signal to stdout
[ ] Raw API errors (500, INTERNAL, stack traces) NEVER reach stdout
[ ] AGENTS.md instructs agent to NEVER forward raw error text
    WITHOUT THIS: Users see "got status: INTERNAL. {"error":{"code":500}}"

# In scripts — safe error output
try:
    result = run_generation()
except Exception as e:
    print(f"GENERATION_FAILED: {e}", file=sys.stderr)  # stderr = hidden
    print("GENERATION_FAILED")  # stdout = safe signal for agent
    sys.exit(1)

10. Secrecy Protocol

File: SOUL.md, AGENTS.md template

[ ] NEVER reveal: model names, costs, API keys, provider names
[ ] NEVER echo forbidden terms when refusing (don't repeat back)
[ ] NEVER explain constraints ("my rules say I can't...")
[ ] Anti-injection: single identity statement + redirect, nothing else
[ ] message-guard hook as Layer 2 (separate LLM evaluates outbound messages)

11. Shared Resource Integrity

File: provision-user.sh

[ ] Shared files (SOUL.md, skills/, hooks/) are symlinked, not copied
[ ] Shared symlinks are effectively read-only (user can't modify source)
[ ] Per-user files (USER.md, AGENTS.md, MEMORY.md) are rendered from templates

12. Registry File Security

File: /workspaces/_registry.json

[ ] Registry contains user IDs, display names, provision dates
    RISK: Any agent can read this (contains all user IDs)
    MITIGATION: workspaceOnly prevents fs tools from reading it
    GAP: exec can still cat it

13. AGENTS.md Template Sync

File: entrypoint.sh

[ ] AGENTS.md.template is synced to ALL user workspaces on container restart
    WITHOUT THIS: Users keep stale instructions after bot update.

14. Background Process Timeout

File: config/openclaw.json

[ ] exec.backgroundMs >= 120000 (for AI image/video generation)
    WITHOUT THIS: 10s default kills generation mid-flight. User gets no response.

"tools": { "exec": { "backgroundMs": 120000, "timeoutSec": 300 } }

15. Media Path Security

[ ] All generated media goes to /tmp/ (OpenClaw allowed dir)
[ ] Critical paths hardcoded in scripts (not agent-provided)
[ ] MEDIA: format is correct (no MIME prefix, no file://)

Security Test Suite (Run Before Launch)

3-Layer Defense Model

For public bots where full sandbox is too expensive:

For true adversarial isolation: sandbox.mode: "all" + scope: "agent" or separate gateways.

Quick Audit Command

To audit a bot directory, check these files exist and contain the right settings:

# Run from bot directory
echo "=== Session Isolation ==="
grep -o '"dmScope"[^,]*' config/openclaw.json

echo "=== Background Timeout ==="
grep -o '"backgroundMs"[^,]*' config/openclaw.json

echo "=== User ID Validation ==="
grep -c 'numeric' provision-user.sh

echo "=== Auth Copy ==="
grep -c 'auth-profiles.json' entrypoint.sh

echo "=== workspaceOnly ==="
grep -c 'workspaceOnly' provision-user.sh entrypoint.sh

echo "=== Error Handling ==="
grep -c 'GENERATION_FAILED' workspace-shared/skills/*/scripts/*.py 2>/dev/null

echo "=== chmod 700 ==="
grep -c 'chmod 700' provision-user.sh

All should return non-zero counts. Zero = missing protection.

Reference: Production Incidents That Led to This Audit