Openclaw Bastion

Prompt injection defense for agent workspaces. Scan files for injection attempts, analyze content boundaries, detect hidden instructions, and maintain command allowlists. Free alert layer — upgrade to openclaw-bastion-pro for active blocking, sanitization, and runtime enforcement.

This skill is generally coherent with its stated purpose (scanning for prompt-injection patterns) but includes commands that can modify, quarantine, or sanitize workspace files and generate canary tokens. Before installing or running it on a real workspace: 1) Review the bundled scripts (scripts/bastion.py) yourself or with a trusted developer to confirm behavior you accept. 2) Back up your workspace and test the tool on a copy first — exercise scan, check, and status only before running sanitize/quarantine/enforce/protect/canary. 3) Inspect .bastion-policy.json after creation to ensure its allowlist/blocklist fits your environment. 4) Because the package source and homepage are unknown, prefer running it in an isolated environment or container until you verify provenance. 5) Note the SKILL.md includes injection-pattern examples (which tripped the static scanner); that is expected for this kind of tool but keep it in mind when interpreting automated scans.

Type: OpenClaw Skill Name: openclaw-bastion Version: 1.0.2 The OpenClaw Bastion skill bundle is a security tool designed to detect and neutralize prompt injection attacks and dangerous commands. Its core functionality involves scanning files, sanitizing hidden Unicode, quarantining compromised files, deploying canary tokens, and generating hooks for runtime defense. While it performs file modifications and movements, these actions are explicitly for defensive purposes (e.g., blocking injections, isolating threats, setting up monitoring). There is no evidence of intentional malicious behavior such as data exfiltration, unauthorized remote control, or persistence for harmful ends. A minor bug exists in `scripts/bastion.py` where the `enforce` command generates a `Bash` hook calling an undefined subcommand (`check-command`), which is a vulnerability in the defense mechanism itself, not an attack.