Install the defense plugin-Agent Security Center( ASC)-阿里云帮助中心

Agent Security Center provides real-time defense to deliver runtime security protection for Agents deployed on the OpenClaw and Hermes platforms, ensuring that your Agents run safely.

Overview

After you install the Agent Security Center defense plugin, the plugin monitors Agent runtime in real time and automatically detects and intercepts security threats such as prompt injection attacks and malicious URL access.

Scope

Supported platforms: OpenClaw and Hermes.

Installation steps

OpenClaw

You can install the defense plugin for OpenClaw in the following two ways:

Automatic installation: applicable only to OpenClaw assets that have been detected by Agent Security Center.
Manual installation: applicable when automatic installation fails, or when the OpenClaw asset has not been automatically detected by Agent Security Center. After installation is complete, related data is automatically synchronized to Agent Security Center.

Automatic installation

One-Click Batch Install:
1. Go to Security Center console - Agent Security Center - Agent Overview. On the Agent Overview page, in the Connected Platforms section for OpenClaw, click Enable Protection Now.
2. In the Enable OpenClaw Real-Time Protection dialog box, select One-Click Batch Install.
  Note
  After the installation task is submitted, it takes approximately 10 minutes to complete. You can close this dialog box. Agent assets are automatically synchronized after installation finishes.
Single Agent installation:
1. Go to the Agent Overview page, click the Agents icon, and open the Agent Details page. Switch the view mode to List.
2. On the Agent list page, search for the OpenClaw product and click in the Security Protection column of the target Agent.
3. In the protection plugin dialog box, click Install Now.

Manual installation

Go to Security Center console - Agent Security Center - Agent Overview. On the Agent Overview page, in the Connected Platforms section for OpenClaw, click Enable Protection Now.
In the Enable OpenClaw Real-Time Protection dialog box, select Manual Installation and copy the installation command. The command uses the following format:
Important
The installation command has a time limit. Check the Expiration Time displayed in the Execute Installation Command section. You must obtain a new command after the current one expires.
```
wget -q "https://update.aegis.aliyun.com/download/openclaw-security-assistant/1.1.0/linux/installer.sh" && chmod +x installer.sh && ./installer.sh install --key "<YOUR-INSTALLATION-KEY>" --autoRestart
```
Log on to the OpenClaw deployment server and run the installation command.
Warning
- The server must have OpenClaw installed and Node.js version >= 22. Run node --version to check the current version.
- The installation process restarts the OpenClaw Gateway. Pause OpenClaw operations before you proceed.
Verify the installation status:
- Method 1: Refresh the Agent Overview page and check whether the Protected count for OpenClaw has increased.
- Method 2:
  1. In the Agent Overview topology area, click the central AGENTS icon.
  2. Open the Agent Details page and switch the view mode to List. If the Security Protection column shows , the installation is successful. For more information, see Security Protection Plugin Installation Status.

Note

To enable real-time defense for self-managed Kubernetes clusters or third-party container clusters, see Real-time protection for container applications.

Hermes

Go to Security Center console - Agent Security Center - Agent Overview. In the upper-left corner, select the region where the asset to be protected is located: Chinese Mainland or Outside Chinese Mainland.
Open the Agent Overview topology area, click the central AGENTS icon, and open the Agent Details page.
Switch to the List view, search for the Hermes Agent product, and click in the Security Protection column of the target Agent.
In the protection plugin dialog box, click Install Now.
Verify that the protection takes effect: open the Agent Details page in List view, and check whether the Security Protection column of the target Agent shows the icon. If yes, the protection is effective.

Uninstall or disable the defense plugin

Go to Security Center console - Agent Security Center - Agent Overview. In the upper-left corner, select the region where the asset to be protected is located: Chinese Mainland or Outside Chinese Mainland.
Open the Agent Overview topology area, click the central AGENTS icon, and open the Agent Details page.
Switch to the List view, and click in the Security Protection column of the target Agent.
In the protection plugin dialog box, select the appropriate option based on your needs:
- Disable Protection: temporarily disables protection. The plugin remains on the server and can be re-enabled at any time.
- Uninstall Now: completely removes the protection plugin. To restore protection, you must perform the installation procedure again.

Troubleshoot plugin installation failures

The following sections describe common installation failure scenarios and troubleshooting suggestions:

"sudo user does not exist" error
- Error message: sudo: unknown user <username> and sudo: error initializing audit plugin sudoers_audit.
- Possible causes:
  - The sudo configuration references a non-existent user, possibly because of an abnormal username format or a deleted user.
  - The sudoers audit plugin failed to initialize, possibly because of the sudo version or PAM configuration.
- Troubleshooting:
  - Check /etc/sudoers and files under /etc/sudoers.d/ for invalid user references.
  - Verify that the user exists by running id <username>.
- Solution: Try to repair the sudoers configuration or reinstall the sudo package.
OpenClaw not detected
- Error message: ERROR: No available openclaw detected (tried global / pnpm / docker).
- Possible causes:
  - OpenClaw is not installed on the server, or the system PATH does not contain the installation path.
  - OpenClaw is deployed through pnpm or Docker, but the installation script cannot detect it.
- Troubleshooting:
  - Verify that OpenClaw is installed and running by running which openclaw or openclaw --version.
  - If OpenClaw is deployed with Docker, verify that the container is running by running docker ps | grep openclaw.
  - If OpenClaw is installed with pnpm, verify that the pnpm global bin directory is in PATH by running pnpm bin -g.
- Solution: Add the OpenClaw executable path to the system PATH and re-run the installation command.
OpenClaw Gateway process missing
- Error message: openclaw-gateway process not found.
- Possible causes:
  - The openclaw-gateway process is not running or is not installed.
  - The gateway process has crashed or exited abnormally.
  - The process name or path does not match the detection script.
- Troubleshooting:
  - Check whether the gateway is installed by running which openclaw.
  - Check the process status by running ps aux | grep openclaw-gateway.
  - Check whether a related systemd service exists by running systemctl status openclaw-gateway.
  - Check the logs to confirm whether the gateway failed to start by running journalctl -u openclaw-gateway or checking the application logs.
- Solution: Restart the gateway by running openclaw gateway restart, or reinstall OpenClaw Gateway.
If the issue persists, submit a ticket to contact technical support.

Billing

Starting from August 25, 2026, the defense plugin provided by Agent Security Center will begin commercial billing. For more information, see Real-time defense capability billing announcement.