OpenClaw is an autonomous AI agent (225,000+ GitHub stars) that reads Slack, updates Notion, sends emails, and monitors your calendar without you copy-pasting between tabs. This lesson covers its four core components (soul.md, user.md, memory, heartbeat.md), the prompt injection and credential risks, and the cost controls needed to avoid runaway API bills.
What you will be able to do
- Configure the four core OpenClaw files (soul.md, user.md, memory, heartbeat.md) to set up a personalized, autonomous agent
- Set hard spending limits (max_daily_tokens, max_monthly_spend, alert_threshold) to prevent surprise API bills
- Recognize and defend against prompt injection attacks that can leak credentials to an attacker
- Choose the right AI model (Claude Sonnet 4.6, Opus 4.6, or Kimi) for each task to control token costs
- Decide whether OpenClaw fits your workflow using the security and data-sensitivity criteria in the decision framework
Before you start
- A VPS (AWS, Hetzner, DigitalOcean) or a dedicated old computer, since OpenClaw should never run on your personal machine
- An Anthropic account with access to Claude models (Sonnet 4.6, Opus 4.6) or another supported AI model
- Comfort with basic technical setup: installing software and editing configuration files like soul.md and heartbeat.md
- Willingness to actively monitor costs and security, especially in the first few weeks
Reference
| Component/Setting | What it does | Example / Value |
|---|---|---|
| soul.md | Defines the agent's personality, tone, role, and boundaries | Pepper Potts (chief of staff), David Goggins (workout coach), Morty (entertainment) |
| user.md | Holds your personal/business context so responses are personalized | Business, schedule, preferences, goals |
| Memory (Rack system) | Persistent memory across sessions | Remembers past decisions, recurring tasks, corrected mistakes |
| heartbeat.md | Automated monitoring and triggered actions | Defines what to monitor, when to check, what actions to trigger |
| max_daily_tokens | Hard cap on daily token usage | 100000 |
| max_monthly_spend | Hard cap on monthly spend | 150 |
| alert_threshold | Warning threshold before hitting the hard cap | 80% |
| Pro Plan vs Max Plan | Anthropic subscription tiers for running OpenClaw | Pro $20/month; Max $100/month (5x more tokens) |
Common errors and fixes
| What goes wrong | The fix |
|---|---|
| Agent given broad Gmail access gets its context overloaded, compacts conversations, loses its original instructions, and bulk-deletes emails (real incident) | Never grant broad access to sensitive systems; restrict OpenClaw to internal workflows only |
| Prompt injection hidden in an email or document overrides the agent's instructions and can send credentials to an attacker | Never let OpenClaw process emails or documents from untrusted sources |
| No hard spending limits configured, so an overnight run racks up $200+ in API charges before you notice (some users report $200/day) | Set max_daily_tokens, max_monthly_spend, and alert_threshold in config, capped at 50-70% of your comfort zone |
| Running OpenClaw on your personal computer risks it reading your personal files, passwords, and financial data if compromised | Run it on a separate VPS or dedicated old computer, and use Tailscale or similar for network isolation |
| Credentials pasted directly into soul.md or user.md as plain text, or full-access API keys handed to the agent | Use environment variables or secure vaults, and use read-only, scoped API tokens wherever possible |
Read the full walkthrough
The complete lesson, with screenshots and any downloads, is published on Substack as part of OpenClaw for Solopreneurs: AI Agents That Work While You Sleep.
Continue the course
Browse all lessons in the OpenClaw for Solopreneurs: AI Agents That Work While You Sleep course, or subscribe to the GenAI Unplugged newsletter to get new lessons in your inbox.
