NC-OC-004

No open (unauthenticated) groups

🔴 Critical ✅ Stable 📊 Contributes to score

What this checks

Checks that no messaging groups are configured with open (unauthenticated) access alongside elevated or runtime tools.

Why it matters

Open groups with elevated tools allow any member to trigger high-impact commands via prompt injection.

How to fix it

Step 1 Identify the open groups. Run the audit to see which groups are flagged:

openclaw security audit --json | jq '.findings[] | select(.checkId | startswith("security.exposure.open_groups")) | .detail'

Step 2 Switch open groups to allowlist mode. In your config, find each flagged group and set groupPolicy to allowlist, then enumerate the allowed user IDs:

channels:
  slack:
    groups:
      - id: "C012AB3CD"
        groupPolicy: allowlist
        allowedUsers:
          - U04S8UTTEHK
          - U09XXXXXXX

Step 3 Remove elevated tools from group contexts. Even with an allowlist, it's good practice to restrict what tools are available in group channels. Set a per-group tool policy that excludes elevated and runtime tools:

        tools:
          exec: false
          elevated: false
          fs: false

Step 4 Restart the gateway to apply changes:

openclaw gateway restart

Step 5 Verify. Re-run openclaw security audit --json and confirm neither open_groups_with_elevated nor open_groups_with_runtime_or_fs appears in findings.

Technical details

Field	Value
Control ID	NC-OC-004
Domain	OC
Severity	Critical
Status	Stable
Data source	`openclaw_security_audit`
Source type	authoritative
Mode	Mode 1 (OpenClaw native)
Introduced in	Library v0.1.0

False positive notes

May fire on intentionally open demo/test groups use exclusions for known-safe configurations.

Suppress this finding

If this finding is intentional or not applicable to your setup, you can exclude it:

clawvitals exclude NC-OC-004 reason "your reason here"

Exclusions are auditable and expire automatically. See the exclusions guide.

← NC-OC-003 All controls NC-OC-005 →