PaperlayerView exact revision on arXiv

Source-linked AI summary

ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection

Wei Zhao, Zhe Li, Peixin Zhang, Jun Sun

arXiv:2604.11790v2cs.CRcs.AI

TL;DR

Tool-augmented LLM agents remain vulnerable to indirect prompt injection because malicious tool-returned content enters their reasoning context as trusted observations. CLAWGUARD enforces user-confirmed, task-specific rules at every tool-call boundary through deterministic runtime checks. Across five models and six injection benchmarks, it substantially improves defense, especially against skill and MCP attacks, while maintaining practical utility.

  • Problem

    Indirect prompt injection exploits the direct integration of malicious tool outputs into agents’ trusted conversation history, creating a security gap for tool-augmented systems.

  • Method

    CLAWGUARD derives task-specific access constraints before external tool use and enforces them at each tool-call boundary without model modification.

  • Results

    CLAWGUARD substantially improves defense success, raising model-averaged DSR on SkillInject from 56.67% to 86.67%, MCPTox from 62.10% to 89.50%, and MSB from 75.86% to 94.21%.

  • Takeaways & Limitations

    Deterministic boundary enforcement provides a practical unified defense, particularly where baseline model defenses are weakest, while maintaining competitive task completion rates.

Abstract

from arXiv · show

Tool-augmented Large Language Model (LLM) agents have demonstrated impressive capabilities in automating complex, multi-step real-world tasks, yet remain vulnerable to indirect prompt injection. Adversaries exploit this weakness by embedding malicious instructions within tool-returned content, which agents directly incorporate into their conversation history as trusted observations. To address these vulnerabilities, we introduce \textsc{ClawGuard}, a novel runtime security framework that enforces a user-confirmed rule set at every tool-call boundary, transforming unreliable alignment-dependent defense into a deterministic, auditable mechanism that intercepts adversarial tool calls before any real-world effect is produced. By automatically deriving task-specific access constraints from the user's stated objective prior to any external tool invocation, \textsc{ClawGuard} blocks all three injection pathways without model modification or infrastructure change. Experiments across five state-of-the-art language models on six injection benchmarks covering web, local, MCP, and skill channels, as well as three utility benchmarks covering OS, web, and code tasks, demonstrate that \textsc{ClawGuard} achieves robust protection against indirect prompt injection without compromising agent utility or introducing significant token overhead. This work establishes deterministic tool-call boundary enforcement as an effective defense mechanism for secure agentic AI systems. Code is publicly available at github.com/Claw-Guard/ClawGuard/.

I. INTRODUCTION

Tool-augmented LLM agents automate complex tasks by iteratively incorporating tool outputs into conversation history, but this trusted integration enables indirect prompt injection. CLAWGUARD addresses the gap with deterministic tool-call boundary enforcement and task-specific rules.

  • Security vulnerability: Adversaries can influence tool outputs and inject malicious instructions into the agent’s reasoning process.Web pages, documents, search results, and other retrieved resources can carry adversarial content that is processed as trusted observations.
  • Defense gap: Existing model-level defenses require fine-tuning and are unavailable for agents using closed-source model APIs.The supplied passage identifies applicability constraints for RLHF-based safety alignment and instruction-hierarchy training.
  • Defense gap: The paper motivates model-agnostic, protocol-agnostic middleware that derives task-specific enforcement rules without model modification, infrastructure change, or domain expertise.This requirement directly motivates runtime enforcement outside the model itself.
  • CLAWGUARD: CLAWGUARD enforces a user-confirmed rule set at every tool-call boundary, intercepting adversarial calls before real-world effects occur.Its approach converts alignment-dependent defense into a deterministic, auditable mechanism.
  • Evaluation: Experiments across five language models and six injection benchmarks show substantial Defense Success Rate improvements, particularly for skill and MCP attacks.The introduction reports broad evaluation across web, local, MCP, and skill channels, with stronger gains where baseline defenses are weaker.
  • Agent workflow: Tool-augmented agents iteratively issue tool calls, append returned outputs to conversation history, and reason over the accumulated context.This workflow supports multi-step tasks but treats tool outputs as observations used for subsequent actions.

B. Threat Model

The threat model considers adversaries that poison tool outputs, web or local content, MCP metadata, or skill files to manipulate agent actions. CLAWGUARD responds with sanitization, rule evaluation, skill inspection, and conservative authorization at tool-call boundaries.

  • Adversary: The adversary controls one or more tool outputs and embeds instructions that enter the conversation history as trusted observations.The model assumes black-box access to tool-output channels rather than access to prompts, prior history, or model weights.
  • Injection channels: Web and local content injection places adversarial instructions in retrieved pages, documents, or search results that the agent processes as tool output.An attacker need only compromise a resource the agent is likely to retrieve.
  • Injection channels: MCP tool poisoning embeds adversarial instructions in tool-description metadata during registration, before the tool is invoked.The attack applies regardless of the provider’s network location because the vulnerability is trusted processing of metadata.
  • Injection channels: Skill file injection exploits directive configuration files whose adversarial additions can be semantically indistinguishable from legitimate behavioral guidance.The paper identifies public skill ecosystems as containing adversarial or policy-violating instructions.
  • Adversarial objectives: Adversarial objectives include data exfiltration, unauthorized actions, and financial manipulation.Examples include transmitting sensitive data, deleting files, executing code, or redirecting payments.
  • Security rationale: Obfuscated or incremental attacks motivate evaluating proposed tool calls at the boundary before any real-world effect occurs.Long, semantically rich tool returns make exhaustive inspection of each observation infeasible.
  • Enforcement architecture: CLAWGUARD places a Content Sanitizer, Rule Evaluator, Skill Inspector, and Approval Mechanism at every tool-call boundary.The framework applies these components to distinct aspects of the active rule set.
  • Content sanitization: Content sanitization redacts sensitive spans from tool arguments and returned content before those values reach execution or conversation history.The pattern library is extensible, and output sanitization prevents sensitive data from propagating into subsequent reasoning.

B. Context-Aware Rule Induction

CLAWGUARD derives task-specific access rules from the user’s objective before tool use, combines them with baseline invariants, and activates them after user confirmation. The resulting authorization pipeline evaluates sanitized calls using the most restrictive applicable verdict.

  • Step 1: Baseline Rule Set: Baseline rules encode organization-wide security invariants, such as blocking credential-store access or restricting external access to approved domains.
  • Step 2: Task-Specific Rule Induction: Task-specific rules cover network domains, local paths, and commands for both native tools and shell execution.
  • Step 2: Task-Specific Rule Induction: Rule induction runs before external tools are invoked using conversation history containing only the user’s stated objective.
  • Step 3: User Confirmation and Rule Activation: The user reviews and may edit task-specific rules, while baseline invariants remain non-negotiable in the activated rule set.
  • Authorization: Baseline rules are evaluated before task-specific rules, so a baseline denial blocks a call despite any permissive task-specific entry.

C. Case Study: End-to-End Enforcement under Adversarial Injection

A blog-summarization task induces and confirms narrowly scoped rules, allowing legitimate retrieval and writing while blocking injected commands. The attack is stopped before execution through both task-specific and system-level denials.

  • Scenario Setup: The case study task retrieves three recent blog posts from pastebin.com/ZddRaJsa and saves the summary to ~/reports/summary.md.
  • Rule Induction: Before tool use, CLAWGUARD activates a confirmed rule set that whitelists the required Pastebin resource and blacklists disallowed destinations.
  • Tool Pass: The permitted web_fetch calls pass because their targets match the induced domain whitelist.
  • Blocked Attack: The injected exec command is blocked because exec violates the task-specific command rule and ~/.ssh/id_rsa violates the baseline filesystem rule.
  • Legitimate Write: The legitimate write to ~/reports/summary.md proceeds without user interruption, allowing the task to complete as intended.
  • Discussion: The scenario demonstrates pre-invocation enforcement and defense in depth through independent tool-domain and filesystem-domain denials.

IV. EXPERIMENTAL EVALUATION

The evaluation examines security performance, operational overhead, and real-world applicability across injection benchmarks, benign agent tasks, and suspicious public skills. These questions distinguish attack resistance from utility cost and deployment realism.

  • RQ1: Security Performance: RQ1 evaluates CLAWGUARD’s effectiveness against indirect prompt injection across web/local, MCP, and skill channels against established defenses.
  • RQ2: Operational Overhead: RQ2 measures utility and token overhead on benign web, operating-system, and coding tasks.
  • RQ3: Real-World Applicability: RQ3 examines performance against malicious or suspicious skills identified from public repositories.
  • Evaluation Scope: Together, the experiments assess safety on established attacks, benign-task costs, and effectiveness in realistic deployments involving publicly distributed suspicious skills.

A. Experiment Setup

The experiments reimplement attack and defense baselines within OpenClaw, evaluate five state-of-the-art LLMs under a conservative approval policy, and report four scenario-level metrics. Results are organized across skill/MCP and web/local benchmarks.

  • Attack Setup: Web/local attacks are reimplemented in OpenClaw, while released MCP and skill benchmarks are directly integrated into its tool and skill systems.
  • Defense Baselines: Task Shield and MELON are reimplemented within OpenClaw while preserving their core detection logic.
  • Implementation: Five state-of-the-art LLMs are evaluated with five-minute task timeouts and default denial of sensitive-action approval requests.
  • Defense Metrics: Completion Rate, Attack Success Rate, Defense Success Rate, and Refusal Rate measure task completion, attack induction, prevention, and refusal-toned responses.
  • Result Organization: Table II covers skill and MCP injection, while Table III covers web and local content injection.

B. RQ1: Security Performance

CLAWGUARD substantially improves security on skill/MCP injection while matching or slightly improving existing defenses on web/local attacks. Its utility cost remains bounded across web, operating-system, and coding tasks, with modest token overhead.

  • Security performance: 71.98% average ASR reduction and 1.93× DSR improvement were achieved for weaker models across skill and MCP settings.For stronger models, DSR reached near-perfect or perfect levels, with remaining attack surface effectively eliminated for Claude-Sonnet-4.6.
  • Security performance: CLAWGUARD delivered 69.58% and 58.93% average improvements over MELON and TASK SHIELD, respectively, on stronger-model skill/MCP settings.It achieved zero ASR in four of six benchmark settings and reduced ASR below 15% in nearly all settings except MCPTox on DeepSeek V3.2.
  • Security performance: On web/local injection, defenses generally achieved near-zero ASR and near-perfect DSR, while CLAWGUARD matched or slightly exceeded prior methods.Residual ASR below 1% remained only on InjecAgent for DeepSeek-V3.2 and Qwen3.5-397B-A17B under CLAWGUARD.
  • Security performance: 56.67%, 62.10%, and 75.86% undefended DSR on SkillInject, MCPTox, and MSB rose to 86.67%, 89.50%, and 94.21% with CLAWGUARD.These correspond to absolute gains of 30.00%, 27.40%, and 18.36%.
  • Operational overhead: 87.4% average utility was retained with zero approvals, increasing to 95.1% with up to three approvals across the utility benchmarks.Zero-approval retention was 88.8% on AgentBench-OS, 78.5% on WebArena, and 94.9% on SWE-bench Lite; three-approval retention was 94.9%, 91.7%, and 98.8%.
  • Operational overhead: 4.98% average token overhead accompanied CLAWGUARD’s bounded utility cost without requiring expensive re-execution.The reported overhead comes mainly from lightweight rule induction and per-step verification.

D. RQ3: Real-World Applicability

CLAWGUARD was evaluated against suspicious skills from a public ecosystem and blocked the large majority of induced malicious behaviors across five attack categories and five backbone models. Its effectiveness varied by attack category and could be affected when inferred authorization rules became imprecise.

  • Evaluation setup: 283 malicious or suspicious skills were identified from 23,794 SkillHub skills, spanning data exfiltration, financial manipulation, persistent compromise, privilege escalation, and unauthorized actions.The categories included 90 data-exfiltration, 40 financial-manipulation, 13 persistent-compromise, 35 privilege-escalation, and 60 unauthorized-action skills.
  • Results: Baseline DSR was weakest for Persistent Compromise and Privilege Escalation, with lowest-performing backbones reaching only 16% and 11%, respectively.Financial Manipulation showed stronger baseline defense, ranging from 22% to 88% across backbones.
  • Caveat: Imprecise inferred rules can cause malicious skill behaviors to be mistakenly treated as task-authorized operations.This limitation constrains the precision of authorization decisions in the suspicious-skill setting.
  • Results: Across five attack categories and five backbone models, CLAWGUARD blocked the large majority of malicious behaviors induced by real-world skill files.The evaluation used three task-relevant prompts per skill generated with GPT-5.4.

B. Indirect Prompt Injection

Indirect prompt injection exploits externally supplied content that agents process within their reasoning context, while existing model-, protocol-, and architecture-level defenses leave important deployment constraints. CLAWGUARD addresses the three channels through automated, user-confirmed runtime rule enforcement without model fine-tuning, protocol coordination, or manual rule authoring.

  • B. Indirect Prompt Injection: Indirect prompt injection embeds adversarial instructions in retrieved external content, redirecting application behavior without access to the system prompt.This attack setting emerged as LLM deployments expanded into application pipelines.
  • B. Indirect Prompt Injection: Agent-specific evaluations report high attack success and weak safety robustness because LLMs cannot reliably distinguish informational context from actionable instructions.Agent-SafetyBench found no evaluated agent above a 60% safety score across 349 safety-relevant scenarios.
  • C. Defenses Against Prompt Injection: Existing model-, protocol-, and architecture-level defenses address different pipeline points but leave agentic systems exposed to context-dependent injection.The defense categories differ in their intervention point and deployment requirements.
  • C. Defenses Against Prompt Injection: RLHF alignment and instruction-hierarchy training require fine-tuning, limiting their applicability to closed-source model APIs.The paper also reports that RLHF-based alignment does not hold against context-dependent injection in agentic pipelines.
  • C. Defenses Against Prompt Injection: Protocol separation can require coordinated changes to models and tool providers, while prompt localization targets adversarial segments rather than fully separating instructions from data.These approaches impose compatibility or remediation trade-offs in heterogeneous ecosystems.
  • C. Defenses Against Prompt Injection: Architecture-level defenses include trusted/untrusted processing separation and runtime constraint languages, but CaMeL is incompatible with dynamically determined tool calls and AgentSpec requires manual rule authoring.Other recent methods compare tool calls across executions to detect attacks.
  • C. Defenses Against Prompt Injection: CLAWGUARD simultaneously addresses all three injection channels without model fine-tuning, protocol coordination, or manual rule authoring.It achieves these properties through automated rule induction confirmed by the user.
  • VI. CONCLUSION: On SkillInject, CLAWGUARD raises DSR from 25.00% to 77.38% for DeepSeek-V3.2 and from 65.48% to 94.05% for GPT-5.4, while Claude-Sonnet-4.6 reaches 100% DSR.Across the three skill/MCP benchmarks, it outperforms MELON and Task Shield by average DSR margins of 18.72% and 10.57%, respectively.

APPENDIX

The appendix describes benchmark construction and judge-based classification for web/local and MCP injection tests. It distinguishes attack prevention from visible refusal, allowing defense success and refusal behavior to be measured separately.

  • Benchmark construction: Web and local benchmarks embed attack payloads in legitimate-looking email, file, or calendar tool responses returned by a mock backend.Agents process these responses as part of their normal execution context.
  • Benchmark construction: MCP attacks place malicious instructions in tool descriptions returned by the tools/list endpoint before any tool is invoked.Poisoned schemas are registered as available OpenClaw tools for the agent’s planning phase.
  • ASR/DSR classification: An LLM judge classifies each case as ATTACK_SUCCESS, DEFENSE_SUCCESS, or INCOMPLETE using the user task, injection, adversarial objective, and execution trace.The execution trace includes textual outputs, tool invocation records, and system logs.
  • ASR/DSR classification: DEFENSE_SUCCESS means the harmful action was not executed, regardless of whether the agent explicitly acknowledged or silently ignored the injection.INCOMPLETE covers timeout or unparseable responses.
  • Refusal classification: Among DEFENSE_SUCCESS cases, a second judge labels behavior EXPLICIT_REFUSAL or SILENT_DEFENSE.The classification uses complete execution traces and system logs to identify visible refusal or blocking messages.
  • Refusal classification: Refusal Rate is the percentage of DEFENSE_SUCCESS cases producing an explicit refusal or blocking message.It measures visible refusal among successfully defended scenarios rather than overall attack prevention.

C. Obfuscation Normalizer

The obfuscation normalizer detects shell-command evasion patterns, converts commands into a canonical form, and escalates medium- or high-obfuscation commands for explicit approval. This provides defense-in-depth against obfuscation variants not covered by baseline rules.

  • Detection: The normalizer detects shell-command obfuscation in two phases: pattern detection followed by normalization.Detected patterns include encoding, substitution, Base64 pipelines, IFS abuse, quote manipulation, backslash escaping, and eval.
  • Detection: Detection covers hex, octal, and Unicode escapes; command substitution; Base64 decode-and-execute patterns; IFS abuse; quote mixing; and excessive backslash escaping.These patterns are intended to identify evasion of pattern-based command detection.
  • Detection: The detector also flags eval because it enables dynamic code execution from obfuscated strings.This rule treats eval as a distinct high-risk indicator.
  • Normalization: Normalization removes quotes, removes common-character backslash escapes, and expands simple variable references into canonical command text.Examples include expanding ${IFS} to a space and $PATH to /usr/bin:/bin.
  • Enforcement: Medium- or high-obfuscation commands are escalated to queue enforcement and require explicit user approval before execution.The weighted obfuscation score supports review of novel variants not explicitly covered by the baseline rule set.

D. Default Sanitization Targets

CLAWGUARD uses a pattern library for content sanitization and baseline safety rules organized by security domain. Its rule-synthesis prompt derives task-specific constraints from the conversation prefix before tool use.

  • Sanitization targets: The Content Sanitizer uses a default pattern library whose entries specify secret categories, coverage, and replacement redaction tokens.
  • Baseline safety rules: Baseline safety rules are organized by domain and use fixed deny or queue actions that task-specific rules cannot override.
  • Baseline safety rules: The framework’s default baseline rules target organizational security invariants, including exfiltration, credential access, persistence, and impact objectives.
  • Rule synthesis: The synthesis prompt combines a system instruction, the conversation prefix H0, and a task block requesting three rule categories.
Loading 2604.11790v2…