Rules of the Claw: Open Source Security Rule Set for OpenClaw Agents
Production Security Rule Set for OpenClaw Agents
Rules of the Claw is a JSON rule set that acts as a hard deny layer on top of agent tool calls in OpenClaw. It addresses the security risk of agents with broad tool access being vulnerable to bad skill installations or prompt injections that could cause real damage.
Key Security Features
- Blocks destructive executions including
rm -rfon workspace/config directories, pipe-to-shell operations, and curl to unknown executables - Protects credential files from reads and writes:
openclaw.json,auth-profiles.json, and files in.secrets/directory - Guards instruction files (
SOUL.md,AGENTS.md) from unauthorized agent edits - Denylists network reconnaissance tools including nmap, masscan, and netcat
- Blocks agent reads of other agents' auth profiles
Technical Implementation
The rule set contains 139 total rules with three preset configurations: minimal, standard, and strict. It ships with a JSON schema, validation scripts, and a one-command install skill. The key design decision is zero LLM dependency - rules execute at the tool layer via regex patterns, providing microsecond latency. Unlike LLM-based guardrails, regex patterns cannot be socially engineered or prompt-injected.
Availability and Licensing
The project is available at github.com/Bahuleyandr/rules-of-the-claw and is MIT licensed. The creator welcomes pull requests for new rule patterns.
📖 Read the full source: r/openclaw
👀 See Also
Claude Code --dangerously-skip-permissions vulnerability and open-source defense tool
Lasso Security published research showing indirect prompt injection vulnerabilities in Claude Code when using --dangerously-skip-permissions flag, with attack vectors including poisoned README files, malicious web content, and MCP server outputs. They released an open-source PostToolUse hook that scans tool outputs against 50+ detection patterns.
OpenClaw Security Vulnerabilities: Critical Framework Flaws Patched in 2026.3.28
Ant AI Security Lab identified 33 vulnerabilities in OpenClaw's core framework, with 8 critical issues patched in the 2026.3.28 release. The vulnerabilities include sandbox bypass, privilege escalation, session persistence after token revocation, SSRF risks, and allowlist degradation.
AI Agent Guardrails Decay Over Time Without Active Maintenance
AI agent guardrails degrade over time as system prompts accumulate updates, model versions change, and new tools are added, often resulting in contradictory or ignored safety rules that require regular review and testing.
NPM Compromise via Axios Backdoor: Impact on AI Coding Agents
On March 31, 2026, a DPRK-linked threat actor compromised npm by publishing backdoored versions of Axios (1.14.1 and 0.30.4) during a 3-hour window. The malware injected a dependency that downloaded a platform-specific RAT, harvested credentials, and self-erased, with AI coding agents like Claude Code and Cursor being particularly vulnerable due to automated npm installs.