Openclaw Traffic Guardian

OpenClaw Traffic Guardian

This is a baseline specification skill. It intentionally does not ship a proxy or runtime implementation yet.

Vercel Skills Installation

Install with the Vercel Skills CLI for this harness:

npx skills add prompt-security/clawsec --skill openclaw-traffic-guardian -a openclaw -y

Release Artifact Verification

For standalone installs, verify the signed release manifest before trusting SKILL.md, skill.json, or the archive. The skill.json file is the package metadata/SBOM source, and the release pipeline signs checksums.json with the ClawSec release key.

set -euo pipefail

SKILL_NAME="openclaw-traffic-guardian"
VERSION="0.0.1-beta3"
REPO="prompt-security/clawsec"
TAG="${SKILL_NAME}-v${VERSION}"
BASE="https://github.com/${REPO}/releases/download/${TAG}"
ZIP_NAME="${SKILL_NAME}-v${VERSION}.zip"
TMP_DIR="$(mktemp -d)"
trap 'rm -rf "$TMP_DIR"' EXIT

RELEASE_PUBKEY_SHA256="711424e4535f84093fefb024cd1ca4ec87439e53907b305b79a631d5befba9c8"

curl -fsSL "$BASE/checksums.json" -o "$TMP_DIR/checksums.json"
curl -fsSL "$BASE/checksums.sig" -o "$TMP_DIR/checksums.sig"
curl -fsSL "$BASE/signing-public.pem" -o "$TMP_DIR/signing-public.pem"
curl -fsSL "$BASE/$ZIP_NAME" -o "$TMP_DIR/$ZIP_NAME"
curl -fsSL "$BASE/SKILL.md" -o "$TMP_DIR/SKILL.md"
curl -fsSL "$BASE/skill.json" -o "$TMP_DIR/skill.json"

ACTUAL_PUBKEY_SHA256="$(openssl pkey -pubin -in "$TMP_DIR/signing-public.pem" -outform DER | shasum -a 256 | awk '{print $1}')"
if [ "$ACTUAL_PUBKEY_SHA256" != "$RELEASE_PUBKEY_SHA256" ]; then
  echo "ERROR: signing-public.pem fingerprint mismatch" >&2
  exit 1
fi

openssl base64 -d -A -in "$TMP_DIR/checksums.sig" -out "$TMP_DIR/checksums.sig.bin"
openssl pkeyutl -verify -rawin -pubin \
  -inkey "$TMP_DIR/signing-public.pem" \
  -sigfile "$TMP_DIR/checksums.sig.bin" \
  -in "$TMP_DIR/checksums.json" >/dev/null

hash_file() {
  if command -v shasum >/dev/null 2>&1; then
    shasum -a 256 "$1" | awk '{print $1}'
  else
    sha256sum "$1" | awk '{print $1}'
  fi
}

verify_manifest_file() {
  asset="$1"
  path="$2"
  expected="$(jq -r --arg asset "$asset" '.files[$asset].sha256 // empty' "$TMP_DIR/checksums.json")"
  if [ -z "$expected" ]; then
    echo "ERROR: checksums.json missing $asset" >&2
    exit 1
  fi
  actual="$(hash_file "$path")"
  if [ "$actual" != "$expected" ]; then
    echo "ERROR: checksum mismatch for $asset" >&2
    exit 1
  fi
}

expected_archive="$(jq -r '.archive.sha256 // empty' "$TMP_DIR/checksums.json")"
if [ -z "$expected_archive" ]; then
  echo "ERROR: checksums.json missing archive.sha256" >&2
  exit 1
fi
actual_archive="$(hash_file "$TMP_DIR/$ZIP_NAME")"
if [ "$actual_archive" != "$expected_archive" ]; then
  echo "ERROR: archive checksum mismatch" >&2
  exit 1
fi

verify_manifest_file "SKILL.md" "$TMP_DIR/SKILL.md"
verify_manifest_file "skill.json" "$TMP_DIR/skill.json"

echo "Signed release manifest, archive, SKILL.md, and skill.json verified."

Only install or extract the archive after this verification succeeds.

Scope

Builders should use this skill as the OpenClaw landing zone for runtime traffic monitoring:

• operator-scoped HTTP proxy inspection
• optional HTTPS inspection with per-process CA trust
• outbound exfiltration detection
• inbound injection detection
• approval-sensitive social-account mutation review
• redacted local threat logs
• optional OpenClaw hook/status integration

Do not merge this capability into clawsec-scanner, openclaw-audit-watchdog, or soul-guardian. Those skills have different trust boundaries and safety contracts.

Safety Contract

• Opt-in only.
• Detect-and-log by default.
• No automatic system CA installation.
• No global HTTP_PROXY or HTTPS_PROXY changes.
• No blocking in the first implementation.
• Redact secrets before logs or conversation alerts.
• Keep all state under OPENCLAW_TRAFFIC_GUARDIAN_HOME or ~/.openclaw/security/clawsec/traffic-guardian.

Builder Entry Points

Read SPEC.md before implementing. Use the placeholder folders as follows:

Required First Implementation Behavior

1. Validate config without starting the proxy. 2. Start monitor in foreground or explicit background mode. 3. Scope proxy environment variables to the target OpenClaw process. 4. Inspect HTTP request/response text up to a bounded byte limit. 5. Support optional HTTPS MITM only when the operator supplies per-process trust configuration. 6. Flag requests matching SPEC.md's Outbound POLICY_REVIEW cases as operator-review findings, including TweetClaw or other X/Twitter automation writes and scheduler/background-runner repeats without a fresh operator-approval marker. 7. Detect repeat/background-runner context from bounded request metadata such as paths, headers, user-agent, client context, tool invocation metadata, or scheduler identifiers. 8. Emit JSONL findings with redacted snippets plus source type, mutation category, approval-marker presence, and direct-operator versus background-runner context. 9. Provide a status command that reports mode, listener, CA fingerprint if present, and last findings.

Out of Scope for v0.0.1 Implementation

• automatic system trust-store mutation
• transparent network interception
• default blocking
• sending traffic to external services
• collecting full request/response bodies

Changelog

[0.0.1-beta3] - 2026-06-10

Security

• Added the POLICY_REVIEW scope for approval-sensitive social-account mutation requests, contributed by @kriptoburak.
• Defined required JSONL metadata for social-account mutation findings, including source type, mutation category, approval-marker presence, and execution context.

Changed

• Clarified that persistent social monitor and webhook configuration changes are review findings, while read-only social research should remain covered by no-false-positive tests.
• Re-released skill package with updated marketplace grouping and signed release trust artifacts for Vercel-compatible skill installation.

[0.0.1-beta2] - 2026-05-13

Security

• Added explicit signed release artifact verification instructions for standalone installs, including checksums.json, checksums.sig, signing-public.pem, archive hash verification, and SKILL.md/skill.json checksum checks.

Changed

• Re-release skill payload metadata after excluding test-only files from release SBOMs and archives.

[0.0.1-beta1] - 2026-05-10

• Added baseline skill metadata, frontmatter, and implementation specification.
• Reserved folder structure for OpenClaw traffic-monitoring runtime code, hook integration, and tests.
• Beta release notes: this release is a scaffold/spec baseline and does not yet ship active runtime proxy interception.
• Beta release notes: defaults remain non-invasive (no automatic traffic mutation or enforcement enabled by default).

OpenClaw Traffic Guardian

Baseline skill for OpenClaw runtime traffic monitoring.

This package is intentionally a spec scaffold. Builders should add the OpenClaw-specific monitor implementation here while preserving the safety contract in SKILL.md and SPEC.md.

Vercel Skills Installation

Install with the Vercel Skills CLI for this harness:

npx skills add prompt-security/clawsec --skill openclaw-traffic-guardian -a openclaw -y

Intended Capability

• detect outbound secret exfiltration in agent HTTP/HTTPS traffic
• detect inbound command-injection and tool-abuse payloads
• record operator-review findings for approval-sensitive social-account mutations
• write redacted local JSONL findings
• provide explicit start, stop, status, and log-query commands
• integrate with clawsec-suite as an optional add-on

Builder Notes

Use SPEC.md as the implementation contract. Keep runtime changes opt-in and scoped to the OpenClaw process being monitored.

OpenClaw Traffic Guardian Specification

Goal

Provide OpenClaw with opt-in runtime traffic monitoring that observes agent HTTP/HTTPS traffic for exfiltration and injection signals without changing global host networking.

Required Architecture

Implement three layers:

1. Detector core

• normalized finding schema
• pattern registry
• snippet redaction
• deduplication
• JSONL report writer

2. OpenClaw adapter

• lifecycle commands for start, stop, status, and threats
• process-scoped proxy environment guidance
• optional hook/status integration under hooks/openclaw-traffic-guardian-hook/

3. Operator interface

• safe setup text
• explicit per-process proxy export commands
• CA fingerprint display when HTTPS inspection is enabled

Finding Schema

Findings must be JSON objects with these fields:

{
  "schema_version": "clawsec-traffic-finding/v1",
  "platform": "openclaw",
  "direction": "outbound",
  "protocol": "http",
  "threat_type": "EXFIL",
  "pattern": "ai_api_key",
  "severity": "high",
  "source": "127.0.0.1",
  "dest": "api.example.com:443",
  "snippet": "[REDACTED]",
  "timestamp": "2026-04-26T00:00:00.000Z"
}

POLICY_REVIEW findings must keep the same base schema and add these fields:

{
  "threat_type": "POLICY_REVIEW",
  "pattern": "social_account_mutation",
  "source_type": "openclaw_tool_request",
  "mutation_category": "post",
  "approval_marker_present": false,
  "execution_context": "background_runner"
}

• source_type: http_request, openclaw_tool_request, or unknown.
• mutation_category: post, reply, repost, like, follow, unfollow, dm, media_upload, persistent_monitor, webhook_config, giveaway_draw, or other_social_account_mutation.
• approval_marker_present: boolean; do not persist marker secrets or full approval tokens.
• execution_context: direct_operator, scheduler, background_runner, or unknown.

Minimum Detection Set

Outbound EXFIL:

• AI API keys
• AWS access key IDs
• private key PEM markers
• SSH key file paths
• sensitive Unix file paths
• dotenv and cloud credential paths

Inbound INJECTION:

• pipe-to-shell commands
• shell exec flags
• reverse shell command shapes
• destructive remove commands
• SSH authorized-key injection shapes

Outbound POLICY_REVIEW:

• social-account write requests such as post, reply, repost, like, follow, unfollow, DM, media upload, persistent monitor creation/update, webhook configuration changes, or giveaway draw actions
• OpenClaw plugin/tool requests that invoke TweetClaw or another X/Twitter automation plugin for account mutation
• scheduler or background-runner requests that would repeat social-account mutations without a fresh operator approval

Safety Requirements

• Default mode is detect-and-log.
• Blocking mode must not exist in the first implementation.
• Snippets must be redacted before persistence.
• Maximum scan bytes must be configurable and bounded.
• CA trust must be per-process by default.
• System trust-store instructions must require explicit operator confirmation and must never run automatically.
• POLICY_REVIEW findings must create an operator-review record only; they must not auto-block, auto-approve, or rewrite the requested action.

Tests Required Before Release

• detector unit tests for each pattern
• redaction tests proving secrets are not persisted
• proxy fixture tests for HTTP request and response inspection
• no-false-positive tests for common benign traffic
• policy-review fixture tests for TweetClaw/social-account mutation examples and benign read-only social research requests
• lifecycle tests for stale PID/state cleanup
• status output tests
• OpenClaw hook integration tests if hook files are added