security-shield

To block destructive commands like rm -rf, you need a runtime guardrail that intercepts tool calls before execution. Security Shield enforces this by blocking dangerous commands such as reverse shells and mkfs across all tool interactions.

Yes, you can redact API keys and tokens from tool outputs automatically. Security Shield inspects tool outputs and redacts sensitive credentials to prevent data leakage during development and incident-response scenarios.

Audit logging for tool activity works by recording all interactions to a local JSONL file. Security Shield logs all tool activity to ~/.openclaw/security-audit.jsonl, providing a persistent record for compliance reviews and security audits.

Yes, secret detection and command blocking apply to all new conversations by default. Security Shield operates across all tool interactions by default, but you can configure specific exceptions if certain tools require unfiltered access.

The best way to prevent data exfiltration during incident response is to enforce runtime monitoring and output redaction. Security Shield guards against unauthorized commands and redacts secrets from tool outputs to protect the user.

Configuring exceptions for destructive command blocking bypasses the default runtime monitoring. You should only configure exceptions for trusted tools, as disabling guardrails removes the protection against data exfiltration and system disruption.