OpenClaw Security Approach Using LLM Router and zrok Private Sharing
A developer has detailed their approach to running OpenClaw and an LLM router inside a VM+Kubernetes environment with a single command, focusing on addressing security concerns around "little lobster" agent systems.
Security Problem and Initial Approach
The project started from concerns about the safety of OpenClaw-like agent systems. The developer notes that sandboxing alone doesn't solve the fundamental security issue: as long as the agent has execution permissions, a simple skill injection could call something like printenv and expose all injected API keys. Removing execution permissions would eliminate about 90% of functionality, and without injecting an LLM API key, the agent can't call the model at all.
LLM Router Solution
The developer initially considered using a service mesh with a sidecar to handle authentication header injection, but OpenClaw's HTTPS enforcement made this impractical. They switched to using an LLM router instead, which allows API key injection at the router level. This approach provides the added benefit of enabling users to inspect conversation logs and build their own monitoring plugins, such as using Claude Code to keep an eye on the agent.
Remote Access via zrok
Another challenge was integrating with communication apps like Slack or Telegram, which requires injecting tokens for remote access. The solution uses zrok private sharing, allowing a remote host to access the agent's admin chat through private sharing without relying on any messaging apps. The developer acknowledges this limits some capabilities—it's a trade-off. Full support for communication apps under this model would require running the gateway and the agent in separate containers, which hasn't been implemented yet.
Project Details
The project has been given the Chinese name "Xiao Long Xia" (小笼虾), with the "笼" character coming from "xiaolongbao" (soup dumplings). The implementation runs OpenClaw and the LLM router inside a VM+Kubernetes environment with a single command.
📖 Read the full source: r/openclaw
👀 See Also
Claude's Security Review Command Has Limitations for Production Systems
A developer found Claude's security review command helpful for basic validation like MIME types and file size limits, but insufficient for production hardening against sophisticated threats. The solution required a two-week architectural overhaul separating file processing into a restricted worker with limited permissions.
Student contributes two security patches to OpenClaw production system
A student developer fixed a 'fail-open' vulnerability in OpenClaw's gateway logic (PR #29198) and a tabnabbing vulnerability in chat images (PR #18685), with both patches landing in production releases v2026.3.1 and v2026.2.24 respectively.
Agent Hush: Open-source tool prevents AI coding agents from leaking sensitive data
Agent Hush is an open-source tool that catches sensitive data before it leaves your machine, created after a developer's AI coding agent leaked API keys, server IPs, and personal info to a public GitHub repo while building a security project.
Rules of the Claw: Open Source Security Rule Set for OpenClaw Agents
An open source JSON rule set with 139 security rules that blocks destructive commands, protects credential files, and guards instruction files from unauthorized agent edits. It operates with zero LLM dependency using regex patterns at the tool layer.