ClawKeeper：通过技能、插件与监视器为OpenClaw智能体提供全方位安全防护

ClawKeeper: Comprehensive Safety Protection for OpenClaw Agents Through Skills, Plugins, and Watchers

March 25, 2026

作者: Songyang Liu, Chaozhuo Li, Chenxu Wang, Jinyu Hou, Zejian Chen, Litian Zhang, Zheng Liu, Qiwei Ye, Yiming Hei, Xi Zhang, Zhongyuan Wang

cs.AI

摘要

OpenClaw已迅速崛起为领先的开源自主智能体运行时，提供包括工具集成、本地文件访问和Shell命令执行在内的强大能力。然而，这种宽泛的操作权限也带来了关键的安全漏洞，使得模型错误可能转化为实际的系统级威胁，如敏感数据泄露、权限提升和恶意第三方技能执行。当前OpenClaw生态系统的安全措施仍高度碎片化，仅针对智能体生命周期的孤立阶段提供保护，缺乏整体性防护方案。为弥补这一空白，我们提出ClawKeeper——一个集成三维防护机制的实时安全框架，其包含三个互补的架构层：（1）基于技能的保护在指令级运作，通过向智能体上下文注入结构化安全策略，实现环境特定约束和跨平台边界管控；（2）基于插件的保护作为内部运行时执行器，在整个执行流水线中提供配置强化、主动威胁检测和持续行为监控；（3）基于监视器的保护引入了一种创新的解耦式系统级安全中间件，可持续验证智能体状态演化。该机制支持在不耦合智能体内部逻辑的前提下实施实时执行干预，例如中止高风险操作或强制人工确认。我们认为这种监视器范式有潜力成为保护下一代自主智能体系统的基础构建模块。大量定性与定量评估表明，ClawKeeper在多样化威胁场景下均展现出卓越的有效性和鲁棒性。我们已公开代码实现。

English

OpenClaw has rapidly established itself as a leading open-source autonomous agent runtime, offering powerful capabilities including tool integration, local file access, and shell command execution. However, these broad operational privileges introduce critical security vulnerabilities, transforming model errors into tangible system-level threats such as sensitive data leakage, privilege escalation, and malicious third-party skill execution. Existing security measures for the OpenClaw ecosystem remain highly fragmented, addressing only isolated stages of the agent lifecycle rather than providing holistic protection. To bridge this gap, we present ClawKeeper, a real-time security framework that integrates multi-dimensional protection mechanisms across three complementary architectural layers. (1) Skill-based protection operates at the instruction level, injecting structured security policies directly into the agent context to enforce environment-specific constraints and cross-platform boundaries. (2) Plugin-based protection serves as an internal runtime enforcer, providing configuration hardening, proactive threat detection, and continuous behavioral monitoring throughout the execution pipeline. (3) Watcher-based protection introduces a novel, decoupled system-level security middleware that continuously verifies agent state evolution. It enables real-time execution intervention without coupling to the agent's internal logic, supporting operations such as halting high-risk actions or enforcing human confirmation. We argue that this Watcher paradigm holds strong potential to serve as a foundational building block for securing next-generation autonomous agent systems. Extensive qualitative and quantitative evaluations demonstrate the effectiveness and robustness of ClawKeeper across diverse threat scenarios. We release our code.