skills.rest
prompt-security
prompt-securityOFFICIAL
Explore all skills by this author →
GitHub

openclaw-traffic-guardian

Defines an opt-in OpenClaw traffic monitoring baseline for detecting exfiltration, injection, and social-account mutations.

1.1k|113|Updated Feb 5, 2026
Search Tags:#Security#policy review#traffic monitoring#injection detection#exfiltration detection#Openclaw#proxy inspection
One-click install
npx skills add https://github.com/prompt-security/clawsec --skill openclaw-traffic-guardian
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: openclaw-traffic-guardian
Source: https://github.com/prompt-security/clawsec/tree/main/skills/openclaw-traffic-guardian
Command: npx skills add https://github.com/prompt-security/clawsec --skill openclaw-traffic-guardian

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

AI agents running on OpenClaw send and receive HTTP/HTTPS traffic that can leak secrets, carry injected commands, or perform social-account mutations without operator approval, and there is no standardized, safety-scoped baseline for monitoring that traffic.

Core Features & Use Cases

  • Traffic Monitoring Specification: Provides a complete implementation contract (SPEC.md) for opt-in HTTP/HTTPS proxy inspection scoped to the OpenClaw process, with no global proxy or system CA changes.
  • Detection Baseline: Defines outbound exfiltration patterns (API keys, private keys, credential paths), inbound injection patterns (pipe-to-shell, reverse shells), and POLICY_REVIEW findings for approval-sensitive social-account mutations such as TweetClaw writes.
  • Safety Contract: Mandates detect-and-log defaults, snippet redaction, bounded scan bytes, and JSONL findings with no auto-blocking or auto-approval.
  • Use Case: A security engineer building runtime protections for an OpenClaw deployment uses this skill as the landing zone and specification to implement a process-scoped monitoring proxy that logs redacted findings for operator review.

Quick Start

Ask your agent to install the openclaw-traffic-guardian skill from prompt-security/clawsec and review SPEC.md to plan the monitoring implementation.

Frequently Asked Questions about openclaw-traffic-guardian

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I monitor OpenClaw agent HTTP traffic for data exfiltration?▼

This skill provides the specification baseline for process-scoped HTTP/HTTPS proxy inspection of OpenClaw traffic. It defines detection patterns for API keys, private keys, and credential paths, with findings written as redacted JSONL records.

What does openclaw-traffic-guardian detect in agent traffic?▼

It specifies outbound exfiltration detection for AI API keys, AWS keys, and private key material, inbound injection detection for pipe-to-shell and reverse shell patterns, and POLICY_REVIEW findings for social-account mutations like posts, follows, and webhook changes.

Does openclaw-traffic-guardian block malicious requests automatically?▼

No. The safety contract mandates detect-and-log mode only, and blocking is explicitly out of scope for the v0.0.1 implementation. POLICY_REVIEW findings create operator-review records without auto-blocking or auto-approving requests.

Is the traffic monitoring proxy already implemented in this skill?▼

No. This release is an intentional spec scaffold with placeholder directories for lib, scripts, and hooks. Builders must implement the detector core, OpenClaw adapter, and operator interface following SPEC.md.

Does it change system proxy settings or install a system CA?▼

No. The safety contract prohibits global HTTP_PROXY or HTTPS_PROXY changes and automatic system trust-store mutation. Proxy environment variables are scoped to the target OpenClaw process, and HTTPS inspection requires explicit per-process CA trust.

Related Skills

Explore More Software Engineering Skills→
BagelHoleBagelHole
46

openclaw-deployment-hardening

Enforce preflight hardening checks and container runtime restrictions for OpenClaw deployments.

Community
Advanced
sjinkssjinks

security-review-owasp-vulnerability-disclosure

Identify vulnerability disclosure control gaps in code, configuration, and workflows.

Community
Advanced
Zhow01Zhow01
52

clawsec-suite

Govern OpenClaw security by monitoring advisories and gating risky removals.

Community
Advanced
xianmingyaoxianmingyao
1

edgeone-clawscan

Audit OpenClaw environments and scan skills for security risks.

Community
Advanced