Portkey Guardrails

Portkey-inspired guardrails for OpenClaw: 5 configurable rules that block prompt injection, redact PII, flag off-scope responses, enforce agent budgets, and...

Do not enable this hook in production without further checks. Specifically: 1) Verify where the handler will import runPreDispatchGuards/runPostDispatchGuards — inspect the host workspace path projects/portkey-gateway-integration/implementation/guardrails/index.ts the handler tries to load; if that file does not exist in your workspace, the handler as-written will fail to load the guardrail module or may import unintended code if a different project provides that path. 2) Confirm the external module's source before allowing it to execute — dynamic import of workspace-relative files can run arbitrary code with the gateway's privileges. 3) Decide whether Ollama should be optional: the package marks it as required in metadata though SKILL.md says it's optional; if you don't want Ollama installed, adjust the metadata or confirm the hook tolerates Ollama absence. 4) Review and test file access policies: G-04 reads agents/<agentId>/BUDGET.json and the system expects to append audit logs to agents/<agentId>/guardrails-audit.md — ensure those paths and permissions are acceptable and that sensitive files are not exposed. 5) If you cannot audit the external guardrails module, prefer running the included rules locally by creating a safe index that imports the provided rules/* files (or ask the publisher to supply a self-contained index) so behavior is deterministic and limited to the packaged code.

Type: OpenClaw Skill Name: portkey-guardrails Version: 1.0.0 The skill bundle contains a significant security risk in `hook/handler.ts`, which dynamically imports executable code from a hardcoded path outside the skill's own directory (`../../projects/portkey-gateway-integration/implementation/guardrails/index.ts`). This 'out-of-bundle' import breaks encapsulation and creates a potential Remote Code Execution (RCE) vector if an attacker can influence the workspace file structure. While the included logic in the `rules/` directory (such as the PII redaction in `G-02-pii-leakage.ts`) appears benign and functional, the handler's mechanism for loading its core logic from an external, unverified path is highly irregular and dangerous.