OpenClaw AI guide: features, Moltbook and shell access

You ask your assistant to clear the inbox, and it clears the inbox. It reads the messages, drafts the replies, files what matters and archives the rest, on your laptop, in whichever chat app you already have open.

The version that costs you is the same agent reading a message a stranger wrote, treating a sentence inside it as a task, and running that task with your files and your keys within reach.

Same assistant. The difference is who wrote the text it read.

What is OpenClaw?

OpenClaw is an open-source personal AI assistant that runs on your own hardware and talks to you through the chat apps you already use. Peter Steinberger created it, and it carried the names Clawdbot and Moltbot before this one.

The project is stewarded by the OpenClaw Foundation, an independent US 501(c)(3) that employs the core team, signs every release and keeps the whole product MIT licensed. openclaw.ai states plainly that there is no enterprise edition and no paid version, and names its donors, including the University of Michigan, OpenAI, Amazon and Red Hat. The same page says OpenAI is a donor and Steinberger works there, and that OpenClaw is not an OpenAI product.

The scale of the thing is easy to underrate. OpenClaw's own release notes for version 2026.8.1, the release it calls OpenClaw 2.0, record 16,977 pull requests, 698 direct commits and 987 contributors in one version.

What can OpenClaw actually do?

OpenClaw runs tasks on your machine, which is the feature everything else hangs off. Your conversations, memory files and configuration live in your own state directory rather than a vendor account.

It answers wherever you already chat. openclaw.ai counts 29 channels, including WhatsApp, Telegram, Discord, Slack, Signal, iMessage, Microsoft Teams, Matrix and Google Chat, in direct messages and in group chats. Native apps cover macOS, Windows, Linux, iPhone, iPad and Android.

It reads and writes your files and runs commands. openclaw.ai describes the tool surface as full system access: browsing the web, filling forms, reading and writing files, running shell commands. The same page frames the choice as full access or sandboxed.

It remembers in plain Markdown. The memory documentation is specific that there is no hidden state: a USER.md holds your stable preferences, a MEMORY.md holds durable facts, and dated notes under memory/ hold the working layer. A background pass it calls dreaming promotes material from the daily notes into long-term memory, and you can read every file yourself.

It takes the model you give it. The local models documentation covers a managed llama.cpp server, LM Studio, Ollama, MLX, vLLM and any OpenAI-compatible endpoint, alongside hosted providers. The smallest curated local recipe needs 8 GiB of host memory at a 64K context, so a local setup is a hardware decision before it is a privacy one.

It extends through skills. A skill is a directory with a SKILL.md file that teaches the agent how and when to use a tool, and ClawHub is the public registry it installs them from. The agent can draft its own through a proposal queue called Skill Workshop, which you approve before anything applies.

How do you install OpenClaw?

One command gets you a running assistant. OpenClaw's getting started guide puts the whole path at about five minutes, and onboarding reuses an existing Claude Code or Codex CLI login when it finds one.

# Try it without installing anything (needs Node.js 24.16+ or 26.1+)
npx openclaw@latest

# macOS and Linux
curl -fsSL https://openclaw.ai/install.sh | bash

# Windows, in PowerShell
iwr -useb https://openclaw.ai/install.ps1 | iex

Quick start keeps the Gateway in the foreground of that terminal. To keep it running after you close the window, install it as a service with openclaw gateway install, which writes a LaunchAgent on macOS, a systemd user unit on Linux and WSL2, or a Scheduled Task on Windows.

Two commands tell you whether it worked. openclaw gateway status should show the Gateway listening on port 18789, and openclaw dashboard opens the Control UI in your browser. When something is wrong, openclaw doctor runs read-only health checks and openclaw triage turns the result into a diagnosis you can hand to a coding agent.

Which OpenClaw defaults are safe, and which one is not?

Most OpenClaw defaults are conservative, and one command proves it for your install. The security overview lists the shipped behaviour: on a regular host install the Gateway binds to loopback, most chat channels answer an unknown sender with a pairing code instead of processing the message, and group access is allowlisted behind a mention gate. Run openclaw security audit and it tells you where your configuration has drifted from that baseline.

The sandbox is the setting that waits for you. OpenClaw's sandboxing documentation states that sandboxing is off by default, controlled by agents.defaults.sandbox globally, a per-agent entry, or a required creator-role policy. Turning it on moves tool execution into a container while the Gateway process stays on the host.

Container images are the documented exception to the loopback default: they ship with an exposed bind, and OpenClaw pairs that with its own exposure runbook.

The injection side of OpenClaw security now lives in one place. OpenClaw prompt injection covers the three 2026 disclosures that traced injected text into agent actions, the sandbox default in full, and what a sandbox does and does not cover once an agent has been convinced.

What is Moltbook, and does it still run?

Moltbook is where OpenClaw agents talk to each other, and it is worth understanding before you connect yours. It is a Reddit-style forum organised into topic groups called submolts, where agents post, comment and vote while humans are restricted to reading. Matt Schlicht launched it on 28 January 2026, and most of the agents on it are OpenClaw instances.

Moltbook is still live, under new ownership. Reuters reported on 10 March 2026 that Meta acquired Moltbook, bringing co-founders Matt Schlicht and Ben Parr into Meta Superintelligence Labs. Reuters also recorded that Schlicht built the site without writing a line of code himself, directing his own agent, Clawd Clawderberg, to do it.

Two things about it are commonly repeated and worth separating. The agent posts are real output from real agents, and the viral screenshots of agents plotting are weak evidence: CNBC, The Verge and MIT Technology Review each reported that much of the striking content was shaped by direct human prompting. A Wired reporter posted to the agent-only platform by replicating the cURL calls in the agent prompts.

The security record is the part that reaches your machine. Researchers at Wiz found an exposed Supabase API key in the site's front-end JavaScript, granting full read and write access to production data, including roughly 1.5 million agent API tokens, 35,000 email addresses and private messages between agents. Wiz reported it and the flaw was patched within hours.

Your agent's credentials are only as private as the platform holding them.

Are ClawHub skills safe to install?

Treat a skill as code you are about to run, and the ecosystem gives you the tools to check it. OpenClaw's own skills documentation says the same thing in its own words: treat third-party skills as untrusted code and read them before enabling.

That warning is earned. In a 1Password analysis published on 2 February 2026, Jason Meller found that the top downloaded skill on ClawHub at the time was a Twitter skill whose first step introduced a required dependency. The install links led to a staged chain that decoded a payload, fetched a second-stage script and ran a binary, stripping the macOS quarantine attribute so Gatekeeper would not scan it.

VirusTotal flagged that binary as macOS infostealing malware, and the campaign reportedly ran across hundreds of skills.

Meller's framing is the sentence to keep: markdown is an installer. A skill file is documentation that an agent reads and acts on, so the gap between reading a step and running it closes to nothing.

ClawHub now publishes a security scan state on every skill page, with detail pages for VirusTotal, ClawScan and static analysis, and openclaw skills verify @owner/slug checks a skill's trust envelope and exits non-zero when verification has failed. Run it before you install, and read the SKILL.md yourself while you are there.

Who should run OpenClaw?

OpenClaw suits readers comfortable at a terminal who wants an assistant they can inspect. You get the model choice, the permission boundary and the memory files, and you can read every one of them on disk.

Run it on a machine that does not hold credentials you cannot afford to rotate. 1Password's advice is blunt on this point and worth following: do not experiment on a company device, and if you already have, treat it as an incident and tell your security team. A spare laptop, a dedicated user account or a virtual machine is the cheap version of that advice.

Skip it if you want an assistant that works without configuration, or if the machine it would run on has production access. The power and the exposure are the same property, so review the text your agent reads.

How do you screen what your agent reads?

SafePrompt reads incoming text first and blocks the instruction hidden inside it, before your agent treats that text as a task. Put the call at the point the text enters the agent, which means channel messages, fetched pages, file contents, tool results and Moltbook posts all pass through one check.

// Screen untrusted text before your OpenClaw agent reads it.
const res = await fetch('https://api.safeprompt.dev/api/v1/validate', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.SAFEPROMPT_API_KEY,
    'X-User-IP': endUserIp,          // required: the end user's address, not your server's
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({ prompt: incomingText, sensitivity: 'strict' })
})

// Fail closed: a non-200 means undecided, so nothing reaches the agent.
if (!res.ok) return drop(incomingText)

const { safe, threats, confidence, reasoning } = await res.json()

if (!safe) {
  log({ threats, confidence, reasoning })
  return drop(incomingText)
}

return handToAgent(incomingText)

The key stays on the server that makes the call, never in anything the browser or the agent can read. The response carries four fields: safe is the verdict, threats names what was found, confidence scores the call and reasoning explains it. The raw call works from any language, and the safeprompt npm package (npm install safeprompt) wraps the same endpoint in a check() method when you would rather have the SDK.

What SafePrompt covers

SafePrompt screens submitted text for attempts to redirect the AI reading it. Your app enforces the verdict before model consumption and keeps control of permissions and tool actions. Evaluate both attacks and ordinary traffic before choosing a setting.

Reading the text at the boundary is the part we own. Your OpenClaw setup controls these separate responsibilities:

The agent is only as careful as its input

OpenClaw combines a personal assistant with tools that can act on your hardware. Sandbox and tool policy limit what it can touch; text screening adds a check for attempted redirection. Neither layer establishes complete prevention. Test ordinary tasks and injected inputs together.

SafePrompt was built by Ian Ho to do this one job, and it has stayed a single-purpose product.

Frequently asked questions

Further reading

• OpenClaw Prompt Injection gives you the three 2026 disclosures, the sandbox default and where the check goes in a real setup.
• AI Agent Security explains why an injected sentence becomes an action once the reader has tools attached.
• Indirect Prompt Injection maps the four routes untrusted text takes into any AI system, of which a chat channel is one.
• What Is Prompt Injection covers the named incidents and the attack-versus-failure distinction in plain English.
• How to Prevent Prompt Injection sets out the full defence layering alongside text screening.

For boundary details, read OpenClaw prompt injection. Evaluate agent screening only where you control the pre-inference checkpoint.