# This Is What Clawdbot Was Missing Source: https://www.youtube.com/watch?v=M3P0hQMQtq0 Recap page: https://rapidrecap.app/video/M3P0hQMQtq0 Generated: 2026-02-04T15:00:38.655+00:00 --- ## Quick Overview The personal AI agent OpenClaw, formerly Clawdbot/Moltbot, is a security nightmare because it runs with high privileges, stores sensitive credentials in plain text in easily accessible local files, and allows running arbitrary shell commands or scripts via community-developed skills, leading to potential credential leaks and unauthorized actions. **Key Points:** - OpenClaw's security model grants the AI agent the same permissions as the user who started it, with no privilege separation between the agent and the host system. - Sensitive data like API keys, bot tokens, and credentials are saved in plain text JSON files (e.g., in ./.openclaw/credentials/whatsapp/default/creds.json) accessible to anyone with system access. - The agent can execute shell commands, read/write files, and run scripts via its 'Skills & Plugins' feature, which poses a risk if malicious skills are installed (one tested skill acted as functional malware). - The system's high token usage due to re-sending the entire conversation history on every query caused API costs to skyrocket, exemplified by one cron job costing ~$128/month. - The project's security policy explicitly lists 'Prompt injection attacks' as out of scope, meaning the developers disclaim responsibility for breaches caused by malicious prompts. - Cisco AI Defense Research identified nine security findings in a sample skill, including critical issues like command injection and tool poisoning, highlighting the danger of community-contributed skills. - Mitigations include running OpenClaw in a sandboxed environment (like Docker), using a separate, non-sensitive account, and manually disabling unnecessary skills. ![Screenshot at 00:04: 44:The core security flaw shown where the agent running in the main account has access to sensitive files like SSH keys, API keys, and passwords, highlighting the lack of necessary privilege separation.](https://ss.rapidrecap.app/screens/M3P0hQMQtq0/00-00-04.jpg) **Context:** The video investigates the security implications of OpenClaw (previously Clawdbot/Moltbot), a self-hosted, open-source personal AI assistant designed to interact with various chat apps and services. The project gained massive popularity rapidly, but this analysis focuses on the severe security risks inherent in its architecture, particularly concerning local data storage, execution privileges, and the use of community-contributed 'skills' that extend its capabilities. ## Detailed Analysis The video concludes that personal AI agents like OpenClaw represent a significant security nightmare due to their extensive system access and poor credential handling. OpenClaw runs with the user's full permissions, enabling it to execute shell commands, read/write files, and run scripts locally. This risk is compounded by community skills, where one tested skill functioned as malware by executing a curl command to exfiltrate data to an external server controlled by the skill author, demonstrating prompt injection vulnerability. Furthermore, sensitive data such as WhatsApp credentials and API keys are stored unencrypted in local JSON files, accessible to anyone with file system access, especially when the agent runs outside a sandbox. The economic cost is also substantial; running a single email monitoring cron job using GPT-4o can cost approximately $128 per month due to the inefficient architecture where every query resends the entire conversation history, leading to context growth and high token consumption. The project's security policy explicitly excludes prompt injection attacks from their scope of responsibility. Recommended mitigations include running OpenClaw within a strictly limited Docker container, using a separate, non-sensitive user account, and manually auditing or disabling community skills, especially those involving sensitive integrations. ### OpenClaw Identity & Functionality - Runs on user machine (Mac, Windows, Linux) - Integrates with Any Chat App (WhatsApp, Telegram, etc.) - Offers Full System Access (read/write files, run shell commands) - Originally Clawdbot, renamed Moltbot, then OpenClaw due to name conflicts (0:07, 0:38, 0:45) ### Security Risks - Agent runs with full user permissions, enabling harmful actions if misconfigured or if malicious skills are installed - Credentials and secrets stored in plaintext JSON files locally (e.g., in .openclaw/credentials) (0:08, 4:27) - Security policy explicitly lists prompt injection attacks as 'Out of Scope' (0:09, 5:35) ### Cost Implications - High token usage due to sending entire conversation history per query (3x overhead shown) - Single cron job estimation reaches ~$128/month using GPT-4o rates (2:09, 2:21) - Context growth causes response times to degrade from 2-12 seconds to nearly 3 minutes (3:36) ### Skill Vulnerabilities - Cisco tested a malicious skill ('What Would Elon Do?') and found nine security findings, two critical, showing skills can facilitate data exfiltration via curl commands (4:56, 5:11) - Skills need verification via the open-source Skill Scanner tool (5:04) ### Mitigation Strategies - Use a separate, non-sensitive account that lacks access to critical system files like SSH keys or passwords (6:43) - Run in a fully isolated virtual machine/Docker container (7:03) - Increase heartbeat interval to 2 hours or more and clear session before sleep to reduce token burn (3:12) ![Screenshot at 00:06: Article headline highlighting that personal AI agents like OpenClaw are a security nightmare.](https://ss.rapidrecap.app/screens/M3P0hQMQtq0/00-00-06.jpg) ![Screenshot at 00:08: The GitHub security policy explicitly listing 'Prompt injection attacks' as out of scope \(00:08-00:09\).](https://ss.rapidrecap.app/screens/M3P0hQMQtq0/00-00-08.jpg) ![Screenshot at 00:47: Article detailing the rapid name changes: Clawd to Moltbot to OpenClaw in just three days \(00:46-00:48\).](https://ss.rapidrecap.app/screens/M3P0hQMQtq0/00-00-47.jpg) ![Screenshot at 02:15: Token cost breakdown showing that a single cron job running 288 times a day costs approximately $128/month using GPT-4o rates \(02:15-02:22\).](https://ss.rapidrecap.app/screens/M3P0hQMQtq0/00-02-15.jpg) ![Screenshot at 06:44: Visual representation of the risk: OpenClaw running in the main account context has access to private keys and passwords, emphasizing the need for isolation \(06:44-06:48\).](https://ss.rapidrecap.app/screens/M3P0hQMQtq0/00-06-44.jpg)