clawwall

Scan outbound tool calls with regex patterns to block or redact secrets and PII.

32|5|Updated Mar 13, 2026
One-click install
npx skills add https://github.com/jiayaoqijia/Ottie --skill clawwall
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: clawwall
Source: https://github.com/jiayaoqijia/Ottie/tree/main/workspace/skills/safety/clawwall
Command: npx skills add https://github.com/jiayaoqijia/Ottie --skill clawwall

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Outbound DLP for OpenClaw — hard regex blocks secrets & PII from leaving the machine. Domain control, no LLM.

Core Features & Use Cases

  • Intercepts and scans every outbound tool call using hard regex patterns to block or redact sensitive content.
  • Runs a local Python service (port 8642) with a lightweight SQLite database to log findings for auditability.
  • Integrates with OpenClaw via a plugin to inspect before_tool_call and enforce policy without data leaving the host.
  • Operates entirely locally with no telemetry, crash recovery, and deterministic replay of actions.

Quick Start

Install the ClawWall service and run it locally to start scanning outbound tool calls.

Frequently Asked Questions about clawwall

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How does outbound data leak prevention work for local LLM tool calls?

Outbound data leak prevention for local tool calls works by intercepting outbound invocations and scanning them with regex patterns to block or redact secrets and PII. This ensures sensitive data is matched and stopped before leaving the host.

Can I block secrets and PII from leaving my machine without sending data to an external service?

Yes, you can block secrets and PII without external services by running a local Python service with a SQLite database. It enforces data leak prevention policies entirely on your domain without relying on LLM analysis.

How do I set up outbound DLP to scan every tool call in an OpenClaw deployment?

To set up outbound DLP in OpenClaw, install the local Python service and integrate the OpenClaw plugin to intercept outbound tool calls. It uses a SQLite database to log findings for auditability.

What is the best way to audit blocked secrets and PII in outbound network traffic?

Auditing blocked secrets and PII in outbound traffic is best handled by logging findings to a local SQLite database. This provides deterministic replay of actions and crash recovery without telemetry.

Does outbound DLP use LLM analysis to detect sensitive information in tool calls?

No, outbound DLP does not use LLM analysis to detect sensitive information. It uses hard regex patterns to scan outbound tool calls and block or redact secrets and PII deterministically.