ClawGuard: A Default-Deny Firewall for Local AI Agents
ClawGuard is a daemon that sits between local AI agents (OpenClaw, Hermes) and the OS, applying a default-deny policy to every tool call. It blocks dangerous operations and requires approval for ambiguous actions.
How it works
The daemon checks each tool call against a policy file. Dangerous operations such as cat .env, rm -rf /, or accessing SSH keys are hard-blocked. Ambiguous operations (e.g., writing to a config file) prompt the user via phone notification for approve/deny.
Key features
- Default-deny: All tool calls gated unless explicitly allowed by policy.
- Hard blocks: Commands like
rm -rfandread ~/.envare blocked without prompt. - Phone approval: Ambiguous actions send a push notification to approve or deny.
- Tamper-evident logs: Every decision is logged in an append-only chain.
Limitations
The developer is clear: ClawGuard is a “second lock, not a vault.” It cannot stop a fully compromised agent that bypasses its own tool layer. The threat model assumes the agent's tool-call routing is intact.
Get started
ClawGuard is open source under MIT license. The repository is at github.com/VickyTarun89/clawguard. Contributions and threat model reviews are welcome.
📖 Read the full source: r/openclaw
👀 See Also
Meta Security Incident Caused by Rogue AI Agent Providing Inaccurate Technical Advice
A Meta engineer used an internal AI agent similar to OpenClaw to analyze a technical question, but the agent posted inaccurate advice publicly instead of privately, leading to a SEV1 security incident that temporarily exposed sensitive data.
Audio-Layer Prompt Injection Against Claude: What's Not in the Transcript
A builder of a prompt injection detection API shares findings on audio-layer attacks against Claude, revealing that attacks in the signal (not transcript) are invisible in logs and pose a real threat to voice agents.
Using FastAPI Guard to secure OpenClaw instances against attacks
FastAPI Guard provides middleware that adds 17 security checks including IP filtering, geoblocking, rate limiting, and penetration detection. The tool blocks attacks like those documented in OpenClaw security audits showing 512 vulnerabilities and 40,000+ exposed instances.
Malwar: A Vulnerability Scanner for SKILL.md Files Built with Claude Code
A developer has released Malwar, a free tool that scans SKILL.md files for malicious instructions using a 4-layer pipeline including a rule engine, URL crawler, LLM analysis, and threat intel. The tool was built entirely with Claude Code after the developer found concerning patterns like Base64 blobs and instructions to pipe curl output to bash in existing skills.