March 26, 2026

I BUILT THE ULTIMATE OPENCLAW SETUP GUIDE

OpenClaw (formerly Clawdbot, briefly Moltbot) is a free, open-source AI agent with over 250,000 GitHub stars. It runs locally, connects to LLMs like Claude or GPT-4o, and executes real tasks through messaging apps — Telegram, Signal, WhatsApp, Discord. Not a chatbot. An execution layer.

You message it "summarize my email and tell me what's on my calendar today" and it does it. You tell it "monitor my Shopify store and alert me when a new order comes in" and it runs that 24/7. You configure it to research stocks every morning and send you a briefing before the market opens — and it does the homework of five analysts before touching a dollar.

The problem: setting it up securely is non-trivial. Over a thousand malicious skills were found on ClawHub. A critical one-click RCE vulnerability was patched. Most guides skip the security model entirely. And if you get it wrong, anyone who can message your bot can read your email and run commands on your machine.

So I built a scripted, secure-by-default setup and open-sourced it. Nine scripts. Ten security layers. Drop the folder into Claude Code, say "set this up," and it handles everything — checking online for the latest versions as it goes so it never installs anything outdated.

Here's what's in it and why every decision was made.

WHY A MAC MINI

OpenClaw is only useful if it's always running. Morning briefings at 7am. Monitoring your stores while you sleep. Scheduled tasks that fire whether your laptop is open or not. You need a dedicated, always-on machine.

One thing every guide buries in the comments: buy a $10 HDMI dummy plug. Without a display connected, macOS degrades — Screen Recording permissions break, Screen Sharing defaults to low resolution, and GUI-dependent operations fail silently. The dummy plug tricks macOS into thinking a monitor is connected. Plug it in, forget about it, and your headless Mini runs perfectly.

You don't need the Pro. The base M4 with 16GB handles one main agent plus two or three sub-agents. The agent spends almost all its time waiting for API responses — raw CPU barely matters.

Headless tip: If you're running the Mac Mini without a monitor, get an HDMI dummy plug ($8 on Amazon). Without one, macOS degrades GPU acceleration silently, which can cause issues with browser-based skills. Plug it in, forget about it.

Remote access: SSH into the Mac Mini from your main machine. For access outside your local network, Tailscale is the simplest option — no port forwarding, no firewall holes. Or use an SSH tunnel: ssh -L 18789:127.0.0.1:18789 [email protected]

A $500 machine drawing $1/month in electricity, running a 24/7 AI agent that costs $2-3/day in API calls. That's the whole stack.

Why not Docker on a VPS? You can. A $10-20/month cloud server works. But you're renting forever, you lose iMessage integration, you lose Apple Keychain, and if the VPS provider has an outage, your agent goes down. A Mac Mini is a one-time purchase that sits in your house, under your control, on your network. For personal and small business use, physical hardware wins. If you're running OpenClaw for a team or need geographic redundancy, use a VPS.

THE SECURITY MODEL

This is the part most guides skip. OpenClaw has full access to whatever you give it — email, files, shell commands, APIs. If configured wrong, anyone who can message your bot can read your email and run commands on your machine. Here's what the setup repo does to lock it down:

THE SETUP

git clone https://github.com/MeriaApp/openclaw-setup.git
cd openclaw-setup

Set up OpenClaw on this machine using the CLAUDE.md guide.

The repo contains 9 scripts that run in sequence:

The CLAUDE.md file instructs Claude Code to search online before each major step for the latest versions and security advisories. So even if you run this six months from now, Claude will verify you're installing the latest stable release with all known patches applied.

Managing It Remotely

The Mac Mini is headless. You'll manage it from your laptop. Two ways to do this:

SSH tunnel — Enable Remote Login in System Settings > General > Sharing. Then from your laptop:

Now localhost:18789 in your browser hits the OpenClaw control panel on the Mini. The gateway stays bound to loopback — never exposed to the network.

Tailscale (free for personal use) — install on both machines and they join an encrypted mesh network. Access the Mini from anywhere — coffee shop, phone, wherever — without opening ports or configuring your router. This is how I manage mine.

WHAT TO ACTUALLY USE IT FOR

The skills ecosystem has 13,700+ options on ClawHub. Most of them are noise. Here's what actually earns its keep:

Morning Briefing

Email Triage

Business Monitoring

Automated Investing

Social Monitoring

Workflow Automation

Start with read-only tasks — briefings, summaries, monitoring. Build trust in the system before enabling anything that sends messages, moves money, or modifies data.

THE COST

Under $100/month for a 24/7 AI agent that handles your briefings, monitors your business, triages your email, and runs scheduled tasks while you sleep. The Mac Mini pays for itself in the first month if you value your morning time at more than $16/day.

WHAT TO WATCH OUT FOR

Malicious Skills

In February 2026, up to 20% of ClawHub skills were found to contain malicious payloads — credential theft, data exfiltration, backdoor installation. One fake trading bot was downloaded 14,000 times before it was pulled. Treat every ClawHub skill like untrusted code.

Before installing any skill: run npx clawhub inspect <skill-name>. Check for curl | bash patterns, base64-encoded payloads, and exfiltration to unknown domains. Run openclaw security audit --deep after every skill install — not just once. The ClawSec skill suite adds config drift detection, automated audits, and skill integrity verification on top of the built-in scanner. Install it.

Prompt Injection

This is the real threat in 2026 — not theoretical, actively exploited. Security researchers have demonstrated exfiltrating SSH keys and API tokens by sending a single crafted email to an inbox that OpenClaw monitors. The agent reads the email, follows the injected instructions, and hands over your secrets. Telegram and Discord link previews have been used as exfiltration channels — the agent generates an attacker-controlled URL that leaks data when the preview loads.

Mitigations that actually work:

• Use a reader agent. Run a separate, tool-disabled agent that summarizes untrusted content (email, web pages). Pass the summary — not the raw content — to your main agent. This breaks the injection chain.
• Keep secrets out of the filesystem. Pass API keys via environment variables, not files the agent can read. The setup repo does this by default.
• Use the best model available. Larger, newer models are significantly more resistant to prompt injection. Don't run a tool-enabled agent on a cheap tier.
• Never give write access to untrusted channels. If the agent reads your email, it shouldn't also be able to send email — at least not until you've watched it operate for weeks.

Updates and Backups

Most OpenClaw failures happen during or immediately after an update. Before any update:

If the update breaks something, restore from backup. If you didn't back up, you're re-doing the entire setup. Run openclaw backup create weekly regardless — it captures your workspace, credentials, skills, and agent history into a single archive.

Overconfidence

The most dangerous failure mode is trusting the agent too much, too fast. Start read-only. Watch what it does. Read the logs. Understand its decisions. Then gradually enable more capabilities. The agent should earn your trust — not receive it on day one.

For the deep dive on automated investing with OpenClaw, see What Happens When You Give an AI $1,000 a Day to Trade Stocks. For how I automate software development, see the Claude Code setup I open-sourced.