ClawKeeper: Comprehensive Safety Protection for OpenClaw Agents Through Skills, Plugins, and Watchers

1. Problem Statement

The paper addresses the critical security vulnerabilities inherent in OpenClaw, a leading open-source autonomous agent runtime. Unlike traditional chatbots, OpenClaw possesses elevated privileges, including the ability to execute shell commands, access local files, and interact with communication software (e.g., Telegram, Feishu). This capability transforms model-level errors into tangible system-level threats, such as:

• Sensitive Data Leakage: Exfiltration of API keys, passwords, and PII.
• Privilege Escalation: Unauthorized modification of system directories or configurations.
• Malicious Execution: Running destructive commands or installing backdoor skills.
• Supply Chain Attacks: Compromise via third-party skills or plugins.

Limitations of Existing Solutions:
Current security measures for OpenClaw are identified as having four major flaws:

1. Fragmented Coverage: Defenses target isolated stages (e.g., only prompt injection or only runtime) rather than the full agent lifecycle.
2. Safety–Utility Tradeoff: Integrated defenses often force the agent to compromise task efficiency for safety, or vice versa.
3. Reactive Nature: Most systems analyze logs after an attack has occurred ("closing the barn door after the horse has bolted").
4. Static Mechanisms: Existing rules cannot adapt to the agent's self-evolving capabilities or emerging threat vectors.

2. Methodology: The ClawKeeper Framework

ClawKeeper proposes a unified, multi-dimensional security framework integrating three complementary architectural layers:

A. Skill-based Protection (Instruction Level)

• Mechanism: Injects structured security policies (defined as Markdown documents) directly into the agent's context via "skills."
• Function: Enforces environment-specific constraints (e.g., Windows vs. Linux file permissions) and software-level norms (e.g., preventing sensitive data transmission via Feishu/Telegram).
• Features: Includes scheduled security scanning and interaction summarization.
• Limitation: Relies on the LLM's ability to follow instructions; vulnerable to prompt injection that attempts to disable the skills.

B. Plugin-based Protection (Runtime Level)

• Mechanism: A hard-coded internal security plugin acting as a runtime enforcer.
• Function:
  • Hardening: Injects safety rules into core config files (e.g., AGENTS.md) and binds gateways to localhost.
  • Threat Detection: Scans for misconfigurations (OWASP Agentic Security guidelines) and CVEs.
  • Configuration Protection: Generates cryptographic hashes of critical files to detect tampering.
  • Behavioral Scanning: Analyzes historical logs for latent threats like prompt injections or credential leaks.
• Limitation: Tightly coupled to OpenClaw, limiting portability; relies on static rules that may miss novel attacks.

C. Watcher-based Protection (External/Decoupled Level)

• Mechanism: Introduces a novel, independent supervisory agent (the "Watcher") that runs separately from the task-executing agent.
• Architecture: The Watcher connects to the task agent via WebSocket, monitoring real-time events (context, tool calls, messages) without executing tasks itself.
• Key Advantages:
  • Regulatory Separation: Decouples safety logic from task logic, eliminating the safety-utility tradeoff.
  • Adversarial Resistance: Since the Watcher is a separate process, it cannot be uninstalled or disabled by the task agent's instructions.
  • Self-Evolution: The Watcher can update its own skills and memory based on new threat patterns, ensuring it evolves alongside the agent.
  • Intervention: Can pause execution and request Human-in-the-Loop (HITL) confirmation for high-risk actions.
• Deployment: Supports both Local (privacy-focused, on-device) and Cloud (centralized governance for enterprises) configurations.

3. Key Contributions

1. Unified Security Framework: The first framework to unify instruction-level (Skills), runtime-level (Plugins), and external-level (Watcher) protections for OpenClaw agents.
2. The Watcher Paradigm: Proposes a decoupled, independent agent architecture for safety oversight, solving the structural limitations of tightly coupled defenses (coupling, static nature, and vulnerability to manipulation).
3. Comprehensive Benchmarking: Developed a benchmark dataset with 140 adversarial instances across 7 threat categories (Prompt Injection, Data Leakage, Privilege Escalation, Dangerous Commands, Config Tampering, Vulnerability Detection, and Malicious Skill Installation).
4. Open Source Implementation: Released the codebase to the community to facilitate further research and adoption.

4. Experimental Results

The authors evaluated ClawKeeper against seven prominent baselines (e.g., OpenGuardrails, ClawSec, SecureClaw) using a Defense Success Rate (DSR) metric.

• Performance: ClawKeeper achieved a DSR of 85–90% across all seven threat categories.
• Comparison: It outperformed the best-performing baselines by 15–45 percentage points.
  • Baselines were highly fragmented; no single baseline covered more than 3 of the 7 categories.
  • Baselines that did cover specific categories often had DSRs of only 60–70%.
• Self-Evolution: In a simulated online learning scenario, the Watcher's DSR improved from ~90% to ~95% as it processed 100 new adversarial cases, demonstrating its ability to learn and adapt, whereas static baselines remained flat.

5. Significance and Impact

• Paradigm Shift: The paper argues that the Watcher model represents a foundational building block for next-generation autonomous systems. By treating safety as a separate, independent regulatory layer (analogous to antivirus software in an OS), it resolves the inherent conflict between task performance and safety compliance.
• Scalability: The framework is designed to be general-purpose. While demonstrated on OpenClaw, the Watcher paradigm can be adapted to any agent system with a communication interface.
• Real-world Applicability: The framework addresses both individual privacy needs (Local deployment) and enterprise governance requirements (Cloud deployment), offering a practical solution for the rapidly expanding ecosystem of autonomous agents.

In conclusion, ClawKeeper moves beyond reactive, fragmented defenses to provide a proactive, adaptive, and structurally robust security layer, setting a new standard for securing autonomous agent ecosystems.