Source-linked AI summary
ClawKeeper: Comprehensive Safety Protection for OpenClaw Agents Through Skills, Plugins, and Watchers
Songyang Liu, Chaozhuo Li, Chenxu Wang, Jinyu Hou, Zejian Chen, Litian Zhang, Zheng Liu, Qiwei Ye, Yiming Hei, Xi Zhang, Zhongyuan Wang
TL;DR
OpenClaw’s broad privileges and extensibility create system-level threats that existing defenses address only fragmentarily. ClawKeeper combines skill, plugin, and independent Watcher protection across the agent lifecycle. The paper reports a 85–90% Defense Success Rate across seven threat categories and outperformance of existing baselines, while noting rule-quality, model-compliance, and plugin-coupling limitations.
Problem
OpenClaw’s shell access, local-file access, and extensible ecosystem create system-level threats, while existing defenses cover only subsets of the agent lifecycle.
Method
ClawKeeper combines instruction-level skills, runtime plugins, and an independent Watcher for external behavior monitoring and intervention.
Results
85–90% Defense Success Rate across all seven threat categories is reported for ClawKeeper, which the authors state outperforms existing baselines.
Takeaways & Limitations
The independent Watcher is presented as a potentially general safety layer beyond OpenClaw, while ClawKeeper mechanisms can be combined according to user priorities.
Takeaways & Limitations
Skill defenses depend on rule quality and model compliance, while plugin defenses remain constrained by OpenClaw coupling and static rules.
Abstract
from arXiv · showhide
OpenClaw has rapidly established itself as a leading open-source autonomous agent runtime, offering powerful capabilities including tool integration, local file access, and shell command execution. However, these broad operational privileges introduce critical security vulnerabilities, transforming model errors into tangible system-level threats such as sensitive data leakage, privilege escalation, and malicious third-party skill execution. Existing security measures for the OpenClaw ecosystem remain highly fragmented, addressing only isolated stages of the agent lifecycle rather than providing holistic protection. To bridge this gap, we present ClawKeeper, a real-time security framework that integrates multi-dimensional protection mechanisms across three complementary architectural layers. (1) \textbf{Skill-based protection} operates at the instruction level, injecting structured security policies directly into the agent context to enforce environment-specific constraints and cross-platform boundaries. (2) \textbf{Plugin-based protection} serves as an internal runtime enforcer, providing configuration hardening, proactive threat detection, and continuous behavioral monitoring throughout the execution pipeline. (3) \textbf{Watcher-based protection} introduces a novel, decoupled system-level security middleware that continuously verifies agent state evolution. It enables real-time execution intervention without coupling to the agent's internal logic, supporting operations such as halting high-risk actions or enforcing human confirmation. We argue that this Watcher paradigm holds strong potential to serve as a foundational building block for securing next-generation autonomous agent systems. Extensive qualitative and quantitative evaluations demonstrate the effectiveness and robustness of ClawKeeper across diverse threat scenarios. We release our code.
1. Introduction
OpenClaw’s powerful, extensible agent runtime creates system-level security risks, while existing defenses remain fragmented, reactive, and difficult to adapt. ClawKeeper unifies skill, plugin, and independent Watcher protections for broader lifecycle coverage and evaluates them qualitatively and quantitatively.
- Security Motivation: OpenClaw’s shell access, local-file access, software integrations, and extensible ecosystem turn model errors into data leakage, unsafe execution, privilege abuse, and persistent compromise.Attack surfaces also arise from skills, plugins, memory, delayed triggers, and compositional interactions.
- Limitations of Existing Defenses: Existing methods typically address only subsets of the agent lifecycle and lack a unified account of their guarantees, assumptions, and coverage gaps.Many solutions are also tightly coupled to particular agent systems.
- Limitations of Existing Defenses: Post-hoc log and behavior analysis motivates a shift toward real-time, proactive defense, while static skill defenses struggle to evolve with changing threats.The paper frames non-adaptive defenses as likely to fall behind an evolving adversarial landscape.
- ClawKeeper: ClawKeeper unifies instruction-level skill protection, runtime plugin enforcement, and an independent external Watcher that monitors events and triggers context-aware responses.The Watcher provides regulatory separation from OpenClaw and governs time-sensitive security mechanisms.
- ClawKeeper: The framework combines broad protection coverage with an independently monitored safety layer that can adapt through updated skills and memory and extend beyond OpenClaw.The authors present the Watcher as a structurally independent, self-improving safety layer.
2. Related Work
Related work traces the evolution of language-model agents toward autonomous planning, tool use, memory, and feedback. It also identifies security threats arising from multi-step action and untrusted interactions, with prompt injection as a prominent attack vector.
- Agent Evolution: Modern LLM agents evolved from conversational systems toward autonomous systems centered on language-based planning, tool use, memory, and feedback.Examples include ReAct, Voyager, MetaGPT, and broader surveyed agent ecosystems.
- Agent Security: Agentic systems introduce threats beyond standalone models through multi-step planning, tool invocation, persistent memory, and interactions with untrusted environments.These capabilities create security concerns specific to agents rather than passive text generation.
- Agent Security: Prompt injection is identified as a primary attack vector because adversarial instructions in external content or tools can manipulate agents into unintended actions.The passage presents prompt injection as one threat within the broader agent-security landscape.
3. Overview
ClawKeeper organizes protection into skill, plugin, and Watcher layers and compares them across safety, compatibility, flexibility, and cost. The overview presents Watchers as strongest for safety, compatibility, and flexibility, while plugins minimize overhead and the mechanisms can be combined according to user priorities.
- Protection Architecture: Skill-based protection operates at the instruction layer, plugin-based protection enforces rules inside the runtime, and Watcher-based protection supplies external monitoring and intervention.The architecture spans context construction, hard-coded runtime enforcement, and independent oversight.
- Safety: Watcher-based protection ranks highest for safety because architectural separation supports continuous monitoring and makes circumvention harder for compromised agents.Plugin-based protection is moderate because predefined rules may miss novel attacks, while skill-based protection depends on prompt quality and model compliance.
- Compatibility and Flexibility: Watcher-based protection offers the strongest compatibility and flexibility through minimal interfaces and centralized updates that avoid changes to individual agents.Plugin compatibility and flexibility are constrained by tight runtime coupling and hard-coded rules.
- Running Cost and Deployment Difficulty: Plugin-based protection has the lowest running overhead, whereas skill and Watcher approaches incur moderate costs from prompt augmentation or continuous independent computation.The cost comparison reflects different deployment mechanisms rather than identical computational burdens.
- Protection Architecture: Users can select and combine ClawKeeper mechanisms according to whether they prioritize runtime efficiency or security performance.The framework is presented as configurable rather than requiring one protection paradigm.
4. Skill-based Protection
Skill-based protection uses interpretable security rules and scripts to enforce environment- and software-specific constraints throughout agent interactions. Its flexibility is limited by rule quality, model compliance, and susceptibility to malicious removal.
- ClawKeeper defines skill-based security rules as structured Markdown documents interpreted and enforced by the agent, supplemented with security scripts.This enables deployment without modifying the underlying framework and supports continuous policy application across interactions.
- The protection covers system constraints across Windows, Linux migration, filesystem access, privilege boundaries, and local task management.
- It also addresses risks from heterogeneous software channels, including Telegram, Feishu (Lark), and DingTalk.These channels expose distinct functional characteristics and risk propagation patterns.
- Scheduled scanning and interaction summarization support periodic runtime inspection, operational transparency, and post-hoc security auditing.
- Skill-based protection remains contingent on security-rule quality and model compliance, and adversaries may instruct the system to remove safety skills.
5. Plugin-based Protection
Plugin-based protection consolidates fragmented defenses into an internal security auditor, scanner, and hardening enforcer. It strengthens configuration integrity and monitoring but remains tightly coupled to OpenClaw and limited against unknown vulnerabilities.
- ClawKeeper integrates and expands existing open-source plugins into a unified internal security solution for OpenClaw.The approach responds to the fragmented coverage of prior plugin defenses.
- The plugin combines auditing, continuous monitoring, threat detection, and hardening across the agent lifecycle.Threat detection targets misconfigurations and known vulnerabilities using OWASP Agentic Security guidelines and relevant CVE databases.
- Hardening injects predefined safety rules and risk-awareness prompts into AGENTS.md so constraints persist across future operations.
- Cryptographic hash backups protect openclaw.json, AGENTS.md, and SOUL.md, while lifecycle monitoring records activities in a secure local log.
- Plugin protection is difficult to apply beyond OpenClaw, relies on static rules, and requires ongoing development to address emerging vulnerabilities.These constraints increase the long-term maintenance burden and motivate a more general security solution.
6. Watcher-based Protection: OpenClaw Overseeing OpenClaw
Watcher-based Protection decouples safety oversight from task execution through an independent supervisory agent. It monitors live execution and can intervene when trajectories become unsafe.
- Motivation: Existing integrated safety components remain vulnerable to task-safety coupling, tampering, static defenses, and limited transparency.They share the task agent’s modification and removal mechanisms and cannot reliably co-evolve with its capabilities.
- Architecture: Watcher-based Protection assigns safety oversight to a dedicated supervisory agent separate from the task-executing OpenClaw.The Watcher communicates with the task agent but does not directly interact with users or perform task-solving activities.
- Runtime Enforcement: The Watcher receives contextual state, tool records, and multi-turn messages through live streaming for real-time safety diagnosis.When it detects an unsafe trajectory, it signals OpenClaw to pause and request explicit user confirmation.
- Advantages: The decoupled design separates task and safety objectives, resists task-level manipulation, and allows monitoring logic to co-evolve independently.Its external process boundary prevents task-level instructions from uninstalling or disabling the Watcher.
- Deployment: ClawKeeper supports local and cloud deployment configurations for privacy-sensitive individual use or centralized supervision of multiple agents.Local deployment preserves on-device data but adds computational overhead, while cloud deployment supports multi-agent and enterprise settings.
7. Quantitative Analysis
ClawKeeper is evaluated on seven categories of adversarial safety tasks using a defined defense-success protocol. It substantially outperforms fragmented baselines, while the Watcher improves further as it processes novel threats.
- Benchmark: The benchmark contains seven safety-task categories with 20 adversarial instances each, split equally between simple and complex examples.The categories cover principal threat vectors identified in OWASP-aligned and open-source defense taxonomies.
- Evaluation Protocol: Defense Success Rate measures the proportion of instances detected and blocked without degrading legitimate functionality.Two independent human annotators review each execution trace across 140 instances.
- Main Results: 15 to 45 percentage points: ClawKeeper surpasses the best-performing baselines across all seven task categories.No baseline covers more than three categories, whereas ClawKeeper reaches 85–90% DSR compared with 60–70% for the best baselines in supported categories.
- Self-Evolving Capability: The Watcher’s DSR rises from approximately 90.0% at initialisation to 95.0% after 100 processed adversarial cases.Skill-based and plugin-based paradigms maintain flat trajectories because new threat knowledge requires developer intervention.
- Self-Evolving Capability: Watcher self-evolution updates monitoring knowledge and confirmation thresholds as novel adversarial patterns are encountered.These mechanisms reduce missed detections and calibrate risk tolerance against observed threats.
8. Qualitative Analysis
Qualitative case studies show ClawKeeper enforcing security across system, software, plugin, and watcher boundaries. The demonstrations include credential protection, autonomous auditing, dangerous-command intervention, and workflow stopping.
- Skill-based Protection: Skill-based protection enforces context-aware security protocols at operating-system and software interaction boundaries.The case studies include mitigation of a localized script and interruption of sensitive credential transmission through Feishu.
- Skill-based Protection: Scheduled self-auditing scans system activity and summarizes software interactions without human intervention.Audits inspect anomalous processes, network connections, directory changes, configuration mismatches, and risky communication events.
- Plugin-based Protection: The plugin Hardening module prevents plaintext credential leakage by injecting risk-aware rules into OpenClaw configuration files.The hardened agent withholds sensitive content instead of reproducing passwords from a local file.
- Plugin-based Protection: The Threat Detection report combines an overall security score of 83/100 with categorized findings and an auto-fixable remediation path.It supplies diagnostic evidence and commands such as npx openclaw clawkeeper harden.
- Watcher-based Protection: The Watcher interrupts dangerous command execution and changes the decision to ask_user, requiring explicit human confirmation.It evaluates the decoded command as a high-risk system-level file-modification operation.
- Watcher-based Protection: The Watcher also detects excessive tool invocations and repeated retries after upstream failures, stopping unsafe execution loops.These cases demonstrate intervention across cumulative tool usage and failure-aware workflow control.
9. Conclusion
ClawKeeper unifies three protection paradigms into full-lifecycle defense for OpenClaw. Across seven threat categories, it achieves 85–90% Defense Success Rate, with the Watcher identified as the most robust and generalizable component.
- ClawKeeper combines skill-based context enforcement, plugin-based runtime hardening, and an independent Watcher for external behavior verification.
- It provides full-lifecycle defense spanning static configuration auditing through real-time execution intervention.
- 85–90% Defense Success Rate was achieved across all seven threat categories against simple and complex adversarial scenarios.
- The Watcher is presented as the most robust and generalizable component because its decoupled architecture resists adversarial manipulation and supports continuous self-evolution.