Is OpenClaw legit and safe to install?
Yes — MIT-licensed, foundation-governed, developed in the open. Where the real risks live instead: lookalike sites, third-party skills, and where you run it.
Yes — OpenClaw is a legitimate open-source project: MIT-licensed, developed in public at github.com/openclaw/openclaw (roughly 385k stars, 500+ contributors), stewarded by the non-profit OpenClaw Foundation, with a creator who now works at OpenAI. The real trust questions sit one level down: whether you’re downloading it from the real source, whether the skills you add are safe, and whether the machine you run it on is set up for an autonomous agent.
Why the project itself checks out
Every marker you’d want from serious open-source software is present and verifiable. The code is public and MIT-licensed, so anyone can read exactly what it does. Governance moved in February 2026 to the OpenClaw Foundation, a non-profit set up when creator Peter Steinberger joined OpenAI — the project is supported by OpenAI but owned by no company. Development is active and visibly so: tens of thousands of commits, hundreds of contributors, a published security policy, and a steady release cadence. None of that is what a scam looks like.
Where the actual risk lives
“Legit” and “risk-free” are different questions, and OpenClaw’s own docs are unusually honest about the second one. Three specifics deserve your attention before you install anything:
- Lookalike sites. OpenClaw’s popularity spawned a crowd of clone documentation and download sites with plausible names and domains — we routinely see several of them outranking the real docs for setup queries. The only official sources are
openclaw.ai,docs.openclaw.ai, and theopenclawGitHub organization — here’s how to verify what you’re installing. - Third-party skills. The software is trustworthy; an arbitrary community skill is not automatically so. Cisco researchers documented a third-party skill that performed data exfiltration via prompt injection — treat skills like browser extensions with shell access and add them deliberately.
- It’s an autonomous agent. A legitimate program that reads files, runs commands, and acts on your behalf still concentrates real power on whatever machine it runs on. That’s not a reason to avoid it — it’s a reason to think about where you run it before you give it your laptop.
Context that reads scarier than it is
If you’ve searched around, you’ve probably hit antivirus-vendor articles and a few alarming headlines. Some deserve their alarm — the skill-supply-chain finding above is real. Others are the ordinary turbulence of a project that grew this fast: the double rename (Clawdbot → Moltbot → OpenClaw came from an Anthropic trademark complaint, not wrongdoing), a Chinese restriction on running it inside state enterprises, and viral stories about agents doing surprising things their operators never asked for. Read those as what they are: evidence that autonomous agents need deliberate boundaries, from a project honest enough to say so itself in its security disclaimer.
A sensible bar before you install
Verify you’re on the real site. Install from npm or the official ghcr.io images, never a random script. Keep the Gateway private — never on the public internet. Add skills you’ve read about, not everything ClawHub offers. Run openclaw security audit after setup. Do those five things and you’re running a legitimate, actively maintained agent with the risk surface managed the way its own developers recommend.