🛡️ ClawGuard OpenClaw Plugin

SOTA security guardrails for OpenClaw agents — Complete Lethal Trifecta defense.

What is the Lethal Trifecta?

The three attack vectors that can compromise an AI agent:

1. Input Attacks (Prompt Injection) - Malicious instructions in user messages or external content
2. Runtime Attacks (Tool Exploitation) - Abusing tool calls for data exfiltration or system compromise
3. Output Attacks (Data Leakage) - Credentials or PII leaking in agent responses

ClawGuard defends against all three with state-of-the-art detection techniques.

Installation

``bash
openclaw plugins install @openclaw/clawguard
`

Then restart your gateway.

SOTA Features

$3

- Pattern-based detection in 7+ languages (EN/KO/JA/ZH/ES/DE/FR/RU)
- Adversarial suffix detection (GCG-style attacks) via entropy analysis
- Multi-turn tracking - detects split payload attacks across messages
- Source-aware thresholds - web content gets stricter scrutiny than user input
- Encoding evasion detection (base64, hex, unicode, homoglyphs)
- Jailbreak and system prompt extraction detection

$3

- Tool call interception with parameter validation
- Dangerous command detection (shell injection, rm -rf, etc.)
- Exfiltration URL blocking (webhook.site, ngrok, etc.)
- Sensitive path protection (.ssh, .aws, .env)
- Optional human-in-the-loop approval gates

$3

- Credential detection (AWS, GitHub, OpenAI, Slack, Discord, Telegram, and 15+ more)
- PII detection (SSN, credit cards, phones, emails, IPs)
- Automatic redaction before output
- Canary token system for prompt leak detection

$3

- Spotlighting - Data marking for untrusted content (Microsoft research)
- Defense presets - paranoid, balanced, permissive
- Structured threat events - Correlation via fingerprinting
- Context decay - Risk scores decay over conversation

Quick Start

$3

`json5
{
plugins: {
entries: {
clawguard: {
enabled: true,
config: {
preset: "balanced" // or "paranoid" or "permissive"
}
}
}
}
}
`

$3

`json5
{
plugins: {
entries: {
clawguard: {
enabled: true,
config: {
inputGuard: {
enabled: true,
threshold: 50,
blockOnDetection: false,
useAdversarialDetection: true,
useMultiTurnTracking: true
},
runtimeGuard: {
enabled: true,
dangerousTools: ["exec", "write", "edit"],
blockExfilUrls: true,
requireApproval: false
},
outputGuard: {
enabled: true,
redactCredentials: true,
redactPII: true,
canaryTokens: ["SECRET_CANARY_12345"]
},
spotlighting: {
enabled: true,
mode: "delimit",
sources: ["web", "email"]
},
logging: {
logThreats: true,
structuredEvents: true
}
}
}
}
}
}
`

Defense Presets

| Preset | Threshold | Block | Adversarial | Multi-turn | Approval | Spotlighting |
|--------|-----------|-------|-------------|------------|----------|--------------|
| paranoid | 25 | ✓ | ✓ | ✓ | ✓ | all sources |
| balanced | 50 | ✗ | ✓ | ✓ | ✗ | web, email |
| permissive | 75 | ✗ | ✗ | ✗ | ✗ | disabled |

CLI Commands

`bash


Check status and stats

openclaw clawguard status

View available presets

openclaw clawguard presets

Test detection with source simulation

openclaw clawguard test "ignore previous instructions" --guard input --source web
openclaw clawguard test "sk-proj-abc123..." --guard output

View recent threat events

openclaw clawguard events --limit 20
`

Slash Command

In any chat, use /clawguard to see current status and session stats.

How It Works

ClawGuard hooks into OpenClaw's plugin lifecycle:

`
User Message
↓
┌─────────────────────────────────────┐
│ INPUT GUARD (before_agent_start) │
│ • Pattern matching (7 languages) │
│ • Adversarial suffix detection │
│ • Multi-turn context tracking │
│ • Source-aware thresholds │
└─────────────────────────────────────┘
↓
┌─────────────────────────────────────┐
│ RUNTIME GUARD (before_tool_call) │
│ • Parameter validation │
│ • Exfil URL blocking │
│ • Dangerous command detection │
└─────────────────────────────────────┘
↓
┌─────────────────────────────────────┐
│ OUTPUT GUARD (message_sending) │
│ • Credential scanning │
│ • PII detection │
│ • Canary token monitoring │
│ • Auto-redaction │
└─────────────────────────────────────┘
↓
Safe Response
`

Research References

- Adversarial Suffixes: Zou et al. "Universal and Transferable Adversarial Attacks on Aligned Language Models"
- Spotlighting: Microsoft "Defending Against Indirect Prompt Injection Attacks"
- Lethal Trifecta: OpenClaw security model
- Multi-turn Attacks: Perez & Ribeiro "Ignore This Title and HackAPrompt"

Testing

`bash
cd projects/clawguard-plugin
bun test # 63 tests
`

File Structure

`
src/
├── index.ts # Plugin entry, lifecycle hooks, CLI
├── guards.ts # Input/Runtime/Output guards
├── patterns.ts # Detection patterns (injection, credentials, PII)
├── analyzers.ts # SOTA: entropy, context tracker, spotlighting
├── guards.test.ts # Guard tests (38)
└── analyzers.test.ts # Analyzer tests (25)
``

License

MIT

Authors

Built by MaxsClawd & Max — Day one, shipped.