DashBot is built on OpenClaw — but deliberately leaves out its most dangerous features. No inbound ports. No OAuth tokens. No browser automation. No plugins. What's left is a hardened, local-first agent that can't be reached from the outside.
DashBot's entire network footprint fits in four lines.
127.0.0.1 WebSocket (Flutter UI ↔ Dart gateway)Each card is a feature DashBot does not implement — and the attack surface that disappears because of it.
OpenClaw pairs with remote devices via Bonjour/mDNS for camera feeds, audio capture, GPS tracking, and sensor data.
No network discovery protocol exposure. No device pairing trust model to compromise. No audio/video capture capabilities. No location tracking.
OpenClaw controls a headless/headed browser — navigating pages, filling forms, clicking elements, extracting content, and logging into sites with stored credentials.
No browser process to exploit. No stored site credentials. No ability to perform actions on authenticated web sessions. No Chrome extension attack surface.
OpenClaw can run tools inside Docker containers and manage sandbox environments for code execution.
No container escape risk. No Docker socket access (which is effectively root). No image pull from untrusted registries.
OpenClaw supports remote gateway connections over the network and mDNS-based auto-discovery of other instances.
DashBot binds to localhost only — no network-exposed ports, no mDNS broadcast, no remote RPC access. The gateway is unreachable from other machines.
OpenClaw accepts inbound HTTP webhooks from external services (Gmail pub/sub, channel callbacks, etc.).
No publicly routable HTTP endpoints. No webhook signature validation to get wrong. No SSRF risk from callback URLs.
OpenClaw handles voice calls with text-to-speech and speech recognition pipelines.
No audio processing pipeline. No phone network integration. No stored voice data. No deepfake voice attack surface.
OpenClaw supports loadable plugins that can extend functionality with arbitrary code execution.
No third-party code execution through plugins. No supply chain risk from untrusted extensions. No dependency confusion attacks.
OpenClaw targets iOS, Android, macOS, Linux, and Raspberry Pi with separate build pipelines and platform-specific code.
Single-platform (Windows) means one attack surface to secure, one build pipeline to audit. No mobile-specific vulnerabilities (app store spoofing, intent hijacking, etc.).
DashBot's security posture is local-first by design. The entire attack surface is:
Every removed feature is a removed attack vector.
Run netstat -an yourself. You'll find exactly one local listener. That's the whole story.