github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-04-19 11:08:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs(security)!: document messaging-only onboarding default and hook/model risk

Browse Source
This commit is contained in:
Peter Steinberger
2026-03-02 18:15:43 +00:00
parent 718d418b32
commit cf5702233c
8 changed files with 20 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
docs/gateway/configuration.md
View File

@@ -291,6 +291,11 @@ When validation fails:
}
```
Security note:
- Treat all hook/webhook payload content as untrusted input.
- Keep unsafe-content bypass flags disabled (`hooks.gmail.allowUnsafeExternalContent`, `hooks.mappings[].allowUnsafeExternalContent`) unless doing tightly scoped debugging.
- For hook-driven agents, prefer strong modern model tiers and strict tool policy (for example messaging-only plus sandboxing where possible).
See [full reference](/gateway/configuration-reference#hooks) for all mapping options and Gmail integration.
</Accordion>