Improve README security defaults

Author: romgenie

CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.1.5 - 2026-05-26
+
+- Improved the README security defaults section for clearer ClawHub rendering.
+- Replaced code-pill-heavy lists with compact operator-focused tables.
+
 ## 0.1.4 - 2026-05-26
 
 - Published through ClawHub's newer ClawPack npm-pack artifact path.

README.md

@@ -101,23 +101,28 @@ MAUTIC_ALLOW_WORKSPACE_WRITE
 
 ## Security Defaults
 
-Installing the plugin does not automatically grant file access or operational Mautic job control.
+The plugin starts in a conservative mode. API access becomes available only after credentials are provided, and operational controls stay off until an operator enables them.
 
-| Area | Default | Guardrail |
+### Default Access
+
+| Capability | Default | What That Means |
 | --- | --- | --- |
-| Mautic API | Available after credentials are provided | Requests are limited to `/api` and `/api/v2`. |
-| Console health check | `migrations:status` only | Allows migration status without maintenance control. |
-| Maintenance commands | Disabled | Requires `allowMaintenanceCommands=true`. |
-| Automation jobs | Disabled | Requires `allowAutomationJobCommands=true`. |
-| Workspace files | Disabled | Read and write are separate opt-ins. |
-| Path access | Guarded | File paths must stay inside `allowedWorkspaceRoot`. |
-
-| Toggle | Commands Enabled | Intended Use |
+| Mautic API | Available after credentials | Requests are limited to Mautic API routes only: /api and /api/v2. |
+| Console status | On | Only migration status is allowed, so OpenClaw can check health without changing Mautic. |
+| Maintenance commands | Off | Cache clearing and plugin reloads require an explicit toggle. |
+| Automation jobs | Off | Campaign, segment, and webhook job execution requires a separate explicit toggle. |
+| Workspace read | Off | File listing and reading are disabled until enabled for a dedicated staging directory. |
+| Workspace write | Off | File writes and deletes are disabled until enabled for a dedicated staging directory. |
+| Filesystem boundary | Always on | Every workspace path must stay inside the configured allowed workspace root. |
+
+### Optional Command Groups
+
+| Setting | Enables | Intended Use |
 | --- | --- | --- |
-| `allowMaintenanceCommands` | `cache:clear`, `mautic:cache:clear`, `plugins:reload` | Routine maintenance after config, plugin, or cache changes. |
-| `allowAutomationJobCommands` | `webhooks:process`, `campaigns:rebuild`, `campaigns:trigger`, `segments:update` | Intentional campaign, segment, and webhook job execution. |
+| allowMaintenanceCommands | cache:clear; mautic:cache:clear; plugins:reload | Routine maintenance after config, plugin, or cache changes. |
+| allowAutomationJobCommands | webhooks:process; campaigns:rebuild; campaigns:trigger; segments:update | Intentional campaign, segment, and webhook job execution. |
 
-Console requests are checked by the plugin allowlist and again by the optional bridge allowlist.
+Console requests are checked twice: first by the plugin allowlist, then by the optional bridge allowlist. For agents that process untrusted input, use restrictive OpenClaw profiles or explicit tool allowlists.
 
 ## Console Bridge
 

docs/CLAWHUB_READINESS.md

@@ -48,7 +48,7 @@ Result:
   "name": "@completetech/openclaw-mautic-plugin",
   "displayName": "Mautic Control",
   "family": "bundle-plugin",
-  "version": "0.1.4"
+  "version": "0.1.5"
 }
 ```
 
@@ -67,7 +67,7 @@ Result: passed. ClawHub detected:
   "name": "@completetech/openclaw-mautic-plugin",
   "displayName": "Mautic Control",
   "family": "bundle-plugin",
-  "version": "0.1.4"
+  "version": "0.1.5"
 }
 ```
 

docs/PRIVATE_SOURCE_REVIEW_REQUEST.md

@@ -6,7 +6,7 @@ Historical/alternate handoff only. The repository is currently public, so this p
 
 - Package name: `@completetech/openclaw-mautic-plugin`
 - Plugin id: `mautic-control`
-- Version: `0.1.4`
+- Version: `0.1.5`
 - Source repository: `CompleteTech-LLC-AI-Research/openclaw-mautic-plugin`
 - Current source visibility: public
 - Branch: `main`

openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "mautic-control",
   "name": "Mautic Control",
   "description": "Typed tools for controlled Mautic REST API access, webhook inspection, optional console maintenance, and optional workspace file staging.",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "contracts": {
     "tools": [
       "mautic_status",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@completetech/openclaw-mautic-plugin",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "OpenClaw plugin for controlled Mautic API, webhook, console bridge, and workspace operations.",
   "type": "module",
   "private": false,