OpenClaw Guardian

A security layer plugin for OpenClaw that intercepts dangerous tool calls (exec, write, edit) through two-tier regex blacklist rules and LLM-based intent ver...

This plugin is internally consistent with its purpose, but before installing: (1) verify the plugin source (the README suggests a GitHub repo) and review the included code yourself or from a trusted reviewer; (2) understand that Guardian will read recent conversation session files and send them to whichever model provider is configured in OpenClaw (so ensure you trust that provider and that it’s configured to not leak sensitive data); (3) check and possibly restrict which provider/config entries it can use, and review the audit log location (~/.openclaw/guardian-audit.jsonl); (4) consider lowering automatic trust (trustBudget) or testing in a safe environment before enabling broadly. If you want, I can point out specific lines to review or summarize exactly which files/fields are sent to the LLM calls.

Type: OpenClaw Skill Name: openclaw-guardian Version: 1.0.1 The OpenClaw Guardian skill bundle is designed as a security layer to intercept and verify dangerous tool calls, implementing a robust two-tier regex blacklist (`scripts/blacklist.ts`) and an LLM-based intent verification system (`scripts/llm-voter.ts`). While its intent is clearly defensive, the LLM verification component is susceptible to prompt injection. The `readRecentContext` function in `scripts/llm-voter.ts` feeds recent user messages directly to the LLM to determine if a dangerous action was explicitly requested. A sophisticated attacker could craft user messages that manipulate the LLM into confirming a blacklisted operation, thereby bypassing the intended security control. This constitutes a significant vulnerability, classifying the skill as suspicious rather than malicious, as the code itself is not designed for harmful behavior but contains a flaw that could be exploited.