DAS05 | 🦞 ClawdBot Complete Guide

Section 01

🔐 CRITICAL SECURITY UPDATE – READ BEFORE USING

⚠️ SECURITY ALERT (Updated February 2026)

IMPORTANT: After publishing this tutorial, multiple CRITICAL security vulnerabilities have been discovered in OpenClaw. This section covers essential security hardening steps you MUST take.

Watch the Security Configuration Video:

📺 Complete OpenClaw Installation – Safe Setup

🚨 Why This Matters

Since our tutorial was published, security researchers have identified:

✖️ CVE-2026-25253 – One-click remote code execution vulnerability
✖️ 341+ malicious skills found in ClawHub repository
✖️ Authentication bypass vulnerabilities
✖️ Plaintext storage of API keys and tokens
✖️ Multiple command injection vulnerabilities

Bottom line: The basic installation is NOT secure by default. You MUST apply these additional security steps.

🔒 Essential Security Hardening (REQUIRED)

Step 1: Secure Your Telegram Bot (CRITICAL)

After completing the main installation, you need to lock down Telegram access. Here’s what we’re doing:

The Problem:

By default, OpenClaw uses "pairing" mode
This means ANYONE can request access to your bot
They can attempt prompt injection attacks
Even with approval, there’s still risk

The Solution:

Switch to "allowlist" mode
ONLY your Telegram ID can message the bot
Everyone else is completely ignored (no response at all)

🎯 Three Commands to Lock Down Telegram

After your bot is running (from PART 7 of the main tutorial), close the terminal and run these three commands:

Command 1: Switch to Allowlist Mode

Prompt

openclaw config set channels.telegram.dmPolicy allowlist

What this does: Changes from "pairing" (anyone can request) → "allowlist" (only approved IDs)

Command 2: Whitelist Your Telegram ID

Prompt

openclaw config set channels.telegram.allowFrom '["YOUR_TELEGRAM_ID"]'

Important: Replace YOUR_TELEGRAM_ID with your actual ID!

How to find your Telegram ID:

Check the bot’s response when you first message it
Or search for @userinfobot in Telegram and send /start
It will show you: Id: 1086205942 (example)

Example:

Prompt

openclaw config set channels.telegram.allowFrom '["1086205942"]'

Command 3: Restart Gateway

Prompt

openclaw restart

What this does: Restarts OpenClaw to apply the security changes

✅ Verification

Test if it worked:

Try messaging the bot from a different Telegram account
Expected result: Complete silence (no response, no rejection message)
If the bot responds: The allowlist didn’t work – double-check your commands

Check your configuration:

Prompt

openclaw config get channels.telegram

Should show:

Prompt

{
  "dmPolicy": "allowlist",
  "allowFrom": ["1086205942"]
}

🛡️ Additional Security Measures

Gateway Password Protection

Set a strong password:

Prompt

openclaw config set gateway.auth.password YOUR_STRONG_PASSWORD

Generate a secure password:

Prompt

openssl rand -base64 32

Enable Sandbox Mode

Force commands to run in containers:

Prompt

openclaw config set tools.exec.host sandbox
openclaw config set tools.exec.approvals.set always

This prevents direct system access even if the bot is compromised.

Firewall Check (VPS Users)

Verify port 18789 is NOT exposed:

Prompt

sudo ufw status
netstat -tlnp | grep 18789

Should ONLY show: 127.0.0.1:18789 (localhost) Should NOT show: 0.0.0.0:18789 (all interfaces)

Restrict Dangerous Tools

Disable or limit high-risk capabilities:

Prompt

openclaw config set tools.allowed '["web_search","file_read"]'
openclaw config set tools.blocked '["exec","browser","web_fetch"]'

Only enable what you actually need.

🚫 What NOT to Install

Avoid ClawHub Skills (For Now)

Why: 341+ malicious skills have been found in the repository

Don’t install:

✖️ Any skills from ClawHub
✖️ Third-party extensions
✖️ "What Would Elon Do?" or other viral skills

Safe approach:

Only use built-in capabilities
Wait for official skill vetting
Review code before installing ANY skill

💰 Cost Warning

OpenClaw can burn through API credits VERY quickly:

One user reported $20 overnight just from time checks
Simple cron jobs can cost $0.75 per execution
Monthly costs can reach $750+ for basic automation

Mitigation:

Use cheaper models (Claude Haiku instead of Opus)
Disable unnecessary background tasks
Set API spending limits with Anthropic
Monitor token usage daily

Check your usage:

Anthropic Console: console.anthropic.com
Set up billing alerts

📋 Security Checklist

Before using OpenClaw, verify:

[ ] Running on VPS/VM (NOT your main computer) ✅
[ ] Telegram dmPolicy set to "allowlist" 🔒
[ ] Only YOUR Telegram ID in the allowlist 🆔
[ ] Gateway password is set 🔑
[ ] Port 18789 NOT exposed to internet 🌐
[ ] Sandbox mode enabled 📦
[ ] Using latest version (post Jan 29, 2026) ⬆️
[ ] No ClawHub skills installed 🚫
[ ] API spending limits configured 💰

🔍 How to Check Your Security

Run Security Audit

Prompt

openclaw security audit

Check OpenClaw Version

Prompt

openclaw --version

If earlier than 2026-01-29, UPDATE IMMEDIATELY:

Prompt

npm update -g openclaw

Review Logs for Suspicious Activity

Prompt

tail -f ~/.openclaw/logs/gateway.log

Look for:

Unauthorized access attempts
Failed authentication
Unusual API usage

🆘 If You Suspect Compromise

Immediate Actions:

Shut down immediately:
Prompt
```
openclaw stop
pkill -9 openclaw
```
Rotate ALL credentials:
- Anthropic API key → console.anthropic.com
- Telegram bot token → Revoke via @BotFather, create new one
- VPS password

Check for data leaks:

Prompt

cat ~/.openclaw/credentials/*
cat ~/.openclaw/memory/*

Consider wiping the VPS:
- If heavily compromised, safest option is fresh install
- Backup non-sensitive data only
- Start from scratch

📚 Additional Resources

Official Security Documentation

Security Research & CVE Details

Cisco: "Personal AI Agents Are a Security Nightmare"
Tenable: "How to Mitigate OpenClaw Vulnerabilities"
The Register: OpenClaw Security Coverage
SecurityWeek: Vulnerability Analysis

Community Support

OpenClaw Discord: For security questions
GitHub Issues: Report vulnerabilities responsibly

⚖️ Updated Disclaimer

This tutorial is for educational purposes.

OpenClaw is in active development and has known security vulnerabilities.

Always:

✅ Use a separate VPS (never your main computer)
✅ Keep API keys secure
✅ Monitor resource usage
✅ Update regularly
✅ Review security documentation

Production use is NOT recommended until security issues are fully resolved.

💡 Recommended Alternatives

If you need a production-ready AI assistant:

Claude Code – Official coding agent from Anthropic (secure, supported)
Claude Cowork – Official desktop automation tool
Direct API Integration – Build custom solutions with Anthropic API
Wait for OpenClaw 1.0 – When security is production-ready

🎓 What You’ve Learned

By completing this security hardening:

✅ Switched from pairing → allowlist mode ✅ Locked Telegram to only your ID ✅ Enabled sandbox mode ✅ Set gateway password ✅ Understand the security risks ✅ Know how to monitor and respond

You now have a MUCH more secure OpenClaw installation.

💬 Questions or Issues?

Found this security guide helpful? Drop a 👍 and share with others learning AI automation!

Have questions? Ask in the community discussion below.

Discovered a vulnerability? Report it responsibly via the OpenClaw GitHub.

Remember: Security is an ongoing process, not a one-time setup. Stay vigilant! 🦞🔒

Last Updated: February 2026 Security status subject to change – always check official docs for latest info

Section 02

🦞 Complete OpenClaw Installation – Safe Setup

"⚠️ IMPORTANT: Before using your bot, read the Critical Security Update to lock down access!"

🚨 IMPORTANT SECURITY WARNING

Do NOT install ClawdBot on your main computer!

There are real security concerns with this tool that need to be addressed. This tutorial shows you how to run it safely in a virtual environment using a VPS (Virtual Private Server), so you can test it without putting your actual system at risk.

📋 What You’ll Learn

By the end of this tutorial, you’ll have:

✅ A secure VPS running Ubuntu 24.04 LTS
✅ ClawdBot/OpenClaw installed and configured
✅ Telegram bot integration for remote access
✅ Background service setup (runs 24/7)
✅ Claude Sonnet 4.5 AI model configured

Time Required: 30-45 minutes
Cost: ~$7/month for VPS hosting
Skill Level: Beginner-friendly (step-by-step)

🛠️ What You’ll Need

Required:

Hostinger VPS account (or any VPS provider)
Anthropic API key (Claude) or OpenAI API key
Telegram account (for bot integration)
Credit card for VPS payment

Optional:

Google Places API key
Other service API keys (can be added later)

📖 Step-by-Step Installation Guide

PART 1: Setting Up Your VPS

Step 1: Purchase Hostinger VPS

Go to Hostinger.com
Navigate to: Servers → VPS Hosting
Select a plan:
- Recommended: KVM 2 ($6.99/month)
- Specs: 2 CPU cores, 8GB RAM, Unlimited storage
- Perfect for running AI bots

Step 2: Configure Your Server

Server Type: Select KVM VPS (Kernel-based Virtual Machine)
- Better stability for Linux systems
Location: Choose closest region to you
- Auto-selected based on your location
- Example: Singapore → Malaysia server
Operating System: Ubuntu 24.04 LTS
- Important: Choose LTS (Long Term Support)
- Gets 5 years of security updates
- More stable than newer versions
Access Credentials:
- Choose Password authentication
- Create a strong password
- Save it securely – you’ll need it later!
Additional Services: (Optional)
- Malware Protection recommended
Complete checkout and wait for setup (~2-3 minutes)

PART 2: Accessing Your Server

Step 3: Open Terminal Access

Go to your VPS Dashboard in Hostinger
Click "Terminal" button (top right)
This opens a direct connection to your server

🔒 Security Note: You’ll see IP addresses and server details – never share these publicly!

PART 3: Installing ClawdBot

Step 4: Get Installation Command

Visit https://openclaw.ai/ (URL may change – check official site)
Find the Quick Start section
Select: macOS / Linux operating system
Copy the one-line installation command

Step 5: Run Installer

Paste command into your VPS terminal
Press Enter
Wait for automatic installation (2-5 minutes)

PART 4: Configuration Wizard

Step 6: Model Selection

When prompted:

Choose AI Provider:

Recommended: Anthropic (Claude)
Alternative: OpenAI (GPT-4)

Authentication:

Select: Anthropic API key
Paste your API key when prompted

Model Selection:

Choose: claude-sonnet-4-5
Best balance of speed, capability, and cost

Step 7: Telegram Bot Setup (Optional but Recommended)

Create Telegram Bot:

Open Telegram
Search for: @BotFather
Send: /newbot
Follow instructions to create bot
Copy the bot token (looks like: 1234567:ABCdefGHI...)

Configure in ClawdBot:

When installer asks for Telegram token
Paste your bot token
Confirm setup

Step 8: Skip Optional Services

For now, select "No" or "Skip" for:

Google Places API
Additional AI providers
Extra skills/plugins

You can add these later!

Step 9: Choose Installation Method

When asked "How do you want to hatch your bot?":

Select: "Hatch in TUI" (recommended)
Press Enter

PART 5: Initial Bot Configuration

Step 10: Set Bot Identity

The bot will ask you several questions:

Example responses:

Prompt

Name: DigiAI (or whatever you want)
Your name: [Your name]
Timezone: Singapore (GMT+8) or your timezone
Bot personality: Professional AI assistant
Emoji: 🤖

Test the connection:

Bot should respond to initial messages
Confirms everything is working

PART 6: Telegram Integration Test

Step 11: Connect Telegram

In the chat, type:

Prompt

I want to connect my Telegram bot. I have the bot token ready. How do I configure it?

Or:

Prompt

Reset Telegram with existing setup

Step 12: Test Telegram Bot

Open Telegram
Find your bot (search for the username you created)
Send: /start or Hello
You should get a response!

PART 7: Making It Run 24/7

Step 13: Exit Interactive Mode

Press Ctrl + C twice
Returns you to command prompt

Step 14: Enable as System Service

Run these three commands one by one:

bash

Prompt

# Command 1: Enable auto-start on boot
systemctl --user enable openclaw-gateway

# Command 2: Start the service now
systemctl --user start openclaw-gateway

# Command 3: Check if it's running
systemctl --user status openclaw-gateway
```

**What you should see:**
```
Active: active (running)

Step 15: Test Permanence

Close the terminal browser tab
Open Telegram
Send a message to your bot
You should still get responses!

🎉 Success! ClawdBot is now running 24/7 in the background.

🔐 Security Best Practices

What to NEVER Share:

❌ Server IP address
❌ Root password
❌ API keys (Anthropic, OpenAI, etc.)
❌ Session tokens in URLs
❌ Telegram bot tokens

What’s Safe to Share:

✅ Operating system info (Ubuntu 24.04)
✅ General setup steps
✅ System resource stats
✅ Tutorial screenshots (with sensitive info blurred)

Execute shell commands
Manage files and directories
Monitor system resources
Schedule tasks with cron
Git operations

Web & Data:

Search the web
Fetch content from URLs
Browser automation
API integrations

Messaging:

Cross-platform messaging (Telegram + more)
Send proactive notifications
Create polls and buttons

Intelligence:

Semantic search across files
Maintain memory and logs
Context-aware responses
Spawn sub-agents for complex tasks

📚 Resources

Official Documentation:

OpenClaw Docs: docs.openclaw.ai
GitHub: github.com/clawdbot/clawdbot

API Keys:

Anthropic Console: console.anthropic.com
OpenAI Platform: platform.openai.com
Telegram BotFather: Search @BotFather in Telegram

Community:

Discord: Check official OpenClaw Discord
GitHub Issues: For bug reports

❓ Troubleshooting

Bot Not Responding?

Check if service is running: systemctl --user status openclaw-gateway
Check logs for errors: journalctl --user -u openclaw-gateway -n 50
Verify API key is correct
Restart service: systemctl --user restart openclaw-gateway

Telegram Bot Not Working?

Verify bot token is correct
Make sure you’ve started the bot with /start
Check if ClawdBot service is running
Look for Telegram-related errors in logs

Installation Failed?

Make sure you’re on Ubuntu 24.04 LTS
Check internet connection on VPS
Try running installer again
Check official docs for latest installation method

🎓 Next Steps

Now that you have ClawdBot running:

Explore Skills – Add plugins for extra functionality
Set Up Automation – Create scheduled tasks
Customize Personality – Adjust bot’s behavior and tone
Add More Channels – Connect WhatsApp, Slack, Discord
Build Workflows – Chain commands for complex tasks

💬 Discussion

Questions? Drop them below!

Share your ClawdBot use cases
Ask for help with specific issues
Suggest topics for future tutorials
Share your automation workflows

⚠️ Disclaimer

This tutorial is for educational purposes. ClawdBot is in active development and security best practices are evolving. Always:

Use a separate VPS (not your main computer)
Keep API keys secure
Monitor resource usage
Update regularly
Review security documentation

Found this helpful? Drop a 👍 and share with others learning AI automation!