openclaw-snitch
A configurable blocklist guard for OpenClaw with three enforcement layers:
- 1. Bootstrap directive — injects a security policy into every agent context
- Message warning — flags incoming messages referencing blocked terms
- Hard block — intercepts and kills the tool call + broadcasts a Telegram alert
Install
Hooks (bootstrap + message guard)
After installing this skill, copy the hook directories into your workspace:
CODEBLOCK0
Then enable them in openclaw.json:
CODEBLOCK1
Plugin (hard block + Telegram alert)
For the hard enforcement layer, install the npm package:
CODEBLOCK2
Then add to openclaw.json:
CODEBLOCK3
Lock down the plugin files after install so the agent can't self-modify:
CODEBLOCK4
Configuration
In openclaw.json under plugins.config.openclaw-snitch:
CODEBLOCK5
| Key | Default | Description |
|---|
| INLINECODE4 | INLINECODE5 | Terms to block (case-insensitive word boundary match) |
| INLINECODE6 |
true | Broadcast Telegram alert to all
allowFrom IDs on block |
|
bootstrapDirective |
true | Inject security directive into every agent bootstrap context |
Hook blocklist (env var)
The hooks read SNITCH_BLOCKLIST (comma-separated) if set, otherwise fall back to the defaults:
CODEBLOCK6
What gets blocked
Blocks fire when the tool name or tool parameters contain a blocked term. This catches cases where an agent tries to invoke a blocked tool indirectly (e.g. exec with clawhub install in the args).
Security notes
- - The hooks in
~/.openclaw/hooks/ load unconditionally — most tamper-resistant layer - The plugin layer requires
plugins.allow — if an agent edits openclaw.json, hooks remain active - INLINECODE17 on the extension dir prevents the agent from self-modifying the plugin
openclaw-snitch
一个可配置的OpenClaw黑名单守卫，包含三个执行层级：
- 1. 引导指令 — 向每个智能体上下文注入安全策略
- 消息警告 — 标记涉及黑名单术语的传入消息
- 硬阻断 — 拦截并终止工具调用，同时广播Telegram警报
安装
钩子（引导 + 消息守卫）
安装此技能后，将钩子目录复制到工作区：
bash
cp -r ~/.openclaw/workspace/skills/openclaw-snitch/hooks/snitch-bootstrap ~/.openclaw/hooks/snitch-bootstrap
cp -r ~/.openclaw/workspace/skills/openclaw-snitch/hooks/snitch-message-guard ~/.openclaw/hooks/snitch-message-guard
然后在openclaw.json中启用它们：
json
{
hooks: {
snitch-bootstrap: { enabled: true },
snitch-message-guard: { enabled: true }
}
}
插件（硬阻断 + Telegram警报）
对于硬执行层级，安装npm包：
bash
npm install -g openclaw-snitch
然后添加到openclaw.json：
json
{
plugins: {
allow: [openclaw-snitch]
}
}
安装后锁定插件文件，防止智能体自我修改：
bash
chmod -R a-w ~/.openclaw/extensions/openclaw-snitch
配置
在openclaw.json的plugins.config.openclaw-snitch下：
json
{
plugins: {
config: {
openclaw-snitch: {
blocklist: [clawhub, clawdhub],
alertTelegram: true,
bootstrapDirective: true
}
}
}
}
| 键 | 默认值 | 描述 |
|---|
| blocklist | [clawhub, clawdhub] | 要阻止的术语（不区分大小写的词边界匹配） |
| alertTelegram |
true | 在阻断时向所有allowFrom ID广播Telegram警报 |
| bootstrapDirective | true | 向每个智能体引导上下文注入安全指令 |
钩子黑名单（环境变量）
如果设置了SNITCH_BLOCKLIST（逗号分隔），钩子将读取该变量，否则回退到默认值：
bash
SNITCH_BLOCKLIST=clawhub,clawdhub,myothertool
阻断条件
当工具名称或工具参数包含被阻止的术语时，将触发阻断。这可以捕获智能体尝试间接调用被阻止工具的情况（例如，参数中包含clawhub install的exec）。
安全说明
- - ~/.openclaw/hooks/中的钩子无条件加载 — 最防篡改的层级
- 插件层级需要plugins.allow — 如果智能体编辑openclaw.json，钩子仍然保持活动状态
- 对扩展目录执行chown root:root可防止智能体自我修改插件
