security-shield

To block dangerous commands during AI tool execution, apply a safety layer that monitors inputs and enforces a deny or warn policy on operations like rm -rf and reverse shells. This prevents harmful actions in real-time.

Secret redaction for API keys works by monitoring outputs from tool invocations and stripping sensitive tokens before they reach the LLM or user. This ensures API keys and tokens are filtered across commands, scripts, and network requests.

To audit blocked commands and secret leaks, log security events to a JSONL file at ~/.openclaw/security-audit.jsonl. This maintains a consistent compliance record across all interactive sessions and automated workflows.

Yes, you can configure and tune enforcement and leakage-detection settings for different environments. The safety layer allows you to adjust deny and warn rules applied across commands, scripts, and network requests per workspace.

Yes, command blocking works across both interactive sessions and automated workflows. The safety layer monitors all tool invocations consistently, ensuring real-time protection whether commands originate from user input or automated scripts.