OpenClaw AI Agents face runtime risks such as prompt injection, data leakage, and malicious command execution. Use AI Guardrails to detect and block threats in real time at both user input and model output stages.
Solution overview
OpenClaw is an open-source AI Agent framework that uses LLMs to complete tasks through natural language. AI Agents face these security risks at runtime:
-
Prompt injection: Crafted inputs manipulate model outputs or trigger unauthorized operations.
-
Sensitive data leakage: Models may expose personal information, corporate secrets, or system credentials in generated content.
-
Malicious command execution: Attackers induce models to access phishing links or download malware.
Alibaba Cloud AI Guardrails provides runtime protection through the openclaw-security-assistant plugin, which detects risks at user input (Prompt) and model output (Response) stages:
-
Input detection: Scans requests for prompt injection and sensitive information before they reach the model.
-
Output detection: Scans model responses for sensitive information leakage and malicious links before they reach users.
-
Audit logs: Records all detection events for querying interception details and post-incident analysis in the console.
Prerequisites
Ensure your server environment meets these requirements before installation.
Environment dependencies
-
Node.js environment: Node.js 22 or later is required.
-
Verification command:
node --version. -
Expected output: v22.0.0 or later.
-
-
OpenClaw installed: OpenClaw must be installed on your system.
-
Verification command:
openclaw -h. -
Expected output: OpenClaw CLI help information.
-
Permission requirements
You must have an Alibaba Cloud account with access to the AI Guardrails console.
Install the plugin
The plugin collects certain data at runtime. Data collection list.
Step 1: Authorize the plugin to call AI Guardrails
-
Log on to the AI Guardrails console . In the left-side navigation pane, click Overview. In the Product Integration section, click OpenClaw to open the OpenClaw plugin panel.
-
In the SLR Authorization section, click Authorize.
-
Complete authorization as prompted.
Step 2: Configure detection policies
-
In the Detection Policy Confirmation section of the OpenClaw plugin panel, click Go to Maintenance.
-
On the agent_runtime_guard - Management page, enable the following recommended dimensions:
-
Sensitive content: Detects personal or corporate sensitive information in LLM interactions to prevent data leakage.
-
Prompt attacks: Detects prompt manipulation that may cause models to output malicious content or compromise system security.
-
Malicious URLs: Detects phishing links, trojan websites, and other URL risks in LLM-generated or parsed content.
Alternatively, in the left-side navigation pane, click Protection Configuration > Configuration. Search for the service named agent runtime protection (Service:
agent_runtime_guard), click Management to enter the agent_runtime_guard - Management page. -
Step 3: Obtain the installation command
In the Get Installation Command section of the OpenClaw plugin panel, copy the installation command.
Example: wget -q "https://update.aegis.aliyun.com/download/openclaw-security-assistant/1.1.0/linux/installer.sh" && chmod +x installer.sh && ./installer.sh install --key "5PfVLF******aK6x8I" --autoRestart
The installation command expires after 24 hours. To prevent leakage, click Refresh in the Installation Command section to regenerate it.
Step 4: Run the installation command
Two installation methods are available:
|
Installation method |
Use case |
Advantages |
Notes |
|
Method 1: OpenClaw automatic installation |
OpenClaw automated deployment |
Automatic installation with immediate protection |
OpenClaw requires installation permissions |
|
Method 2: Manual installation on server |
Manual installation control required |
Pre-installation dependency checks, controllable process |
Requires manual status verification and Gateway restart |
OpenClaw automatic installation
Send the installation command from Step 3 to OpenClaw through its UI or a configured IM channel. OpenClaw automatically installs the plugin. Example prompt:
Execute the following command to install the security plugin:
wget -q "https://update.aegis.aliyun.com/download/openclaw-security-assistant/1.1.0/linux/installer.sh" && chmod +x installer.sh && ./installer.sh install --key "5PfVLF******aK6x8I" --autoRestartManual installation on server
Log on to the target server and run the installation command from Step 3:
wget -q "https://update.aegis.aliyun.com/download/openclaw-security-assistant/1.1.0/linux/installer.sh" && chmod +x installer.sh && ./installer.sh install --key "5PfVLF******aK6x8I" --autoRestartThe OpenClaw Gateway restarts during installation to activate the plugin.
Step 5: Verify plugin installation
Run the following command to check the plugin status:
openclaw plugins info @alicloud/openclaw-security-assistantOutput similar to the following indicates a successful installation:
@alicloud/openclaw-security-assistant
id: openclaw-security-assistant
Security assistant plugin by Alibaba Cloud that provides LLM request/response protection, tool call security checks.
Status: loaded
Source: ~/.openclaw/extensions/openclaw-security-assistant/bundle.js
Origin: global
Version: 1.1.0
Services: openclaw-security-assistant-auth, openclaw-security-assistant-asset-report
Install: npm
Spec: @alicloud/openclaw-security-assistant
Install path: ~/.openclaw/extensions/openclaw-security-assistant
Recorded version: 1.1.0
Installed at: 2026-04-01T09:49:36.232ZStep 6: Test protection
-
Send test requests with risky content (sensitive words, anomalous instructions) through OpenClaw.
-
Check interception logs in the console:
-
Log on to the AI Guardrails console. In the left-side navigation pane, click Test Results > Result Query.
-
On the Model/Claw Protection tab, filter by Service (
agent_runtime_guard) and relevant time conditions to view interception logs.
-
Uninstall the plugin
To stop protecting OpenClaw with AI Guardrails, uninstall the plugin.
Uninstallation removes the plugin and its configuration. Protection stops immediately.
Before uninstalling:
-
Confirm no active protection policies exist in the console.
-
Ensure business traffic uses alternative protection solutions.
Run the following command to uninstall the plugin:
wget -q "https://update.aegis.aliyun.com/download/openclaw-security-assistant/1.0.0/linux/openclaw-security-assistant-install.sh" && chmod +x openclaw-security-assistant-install.sh && ./openclaw-security-assistant-install.sh uninstallVerify the plugin has been removed:
openclaw plugins listAfter uninstallation, runtime protection no longer applies to OpenClaw Agents. Security policies in the AI Guardrails console are no longer enforced.
Troubleshooting
Common issues and solutions:
|
Issue |
Possible cause |
Troubleshooting steps |
|
Installation command fails |
Node.js version below 22 |
Run |
|
OpenClaw CLI not installed |
Run |
|
|
Network connection failure |
Check network connection, ensure access to npm mirrors and Alibaba Cloud APIs |
|
|
Insufficient permissions |
Confirm current user has OpenClaw installation permissions, or use sudo |
|
|
Plugin installed but not activated |
Gateway not restarted |
Manually restart OpenClaw Gateway: |
|
Plugin configuration file corrupted |
Reinstall plugin and verify configuration file integrity |
|
|
Interception not effective |
Console authorization not completed |
Log on to console to check authorization status, re-execute authorization configuration |
|
Console policy configuration not enabled |
Enter policy configuration page to confirm protection dimensions are enabled |
|
|
Test request did not trigger detection rules |
Enhance risk characteristics of test request (e.g., add more obvious sensitive words) |
|
|
No detection results in console |
Plugin not properly connected to Protection Server |
Check network connection, confirm plugin can access Protection Server (domain: protection-server.aliyun.com) |
|
Detection result reporting delay |
Wait 1-2 minutes then refresh console page |
Data collection list
The plugin collects four types of data for runtime protection:
The plugin does not collect the following sensitive headers: Authorization, X-API-Key, API-Key, apikey, X-Auth-Token, auth-token, Cookie, Set-Cookie
Device and environment information
|
Data item |
Description |
Purpose |
|
machine_id |
Device unique identifier |
Identify device identity for security auditing |
|
platform |
Operating system platform (e.g., Linux, Windows) |
Identify runtime environment type |
|
arch |
CPU architecture (e.g., x64, arm64) |
Adapt platform features |
|
node_version |
Node.js version number |
Ensure compatibility |
|
openclaw_version |
OpenClaw version number |
Adapt OpenClaw version features |
OpenClaw configuration information
|
Data item |
Description |
Purpose |
|
gateway_config |
Gateway configuration (port, timeout settings, etc.) |
Analyze traffic characteristics |
|
provider_list |
Configured provider list |
Identify LLM providers |
|
agent_list |
Created agent list |
Identify application scenarios |
|
skill_config |
Skill configuration information |
Analyze tool invocation chain |
|
plugin_list |
Installed plugin list |
Identify potential conflicts |
LLM request/response content (security audit)
|
Data item |
Description |
Purpose |
|
user_prompt |
User-input prompt |
Detect prompt attacks and sensitive content |
|
system_prompt |
System prompt |
Detect configuration risks |
|
llm_response |
LLM-generated response content |
Detect content compliance and sensitive information leakage |
|
model_name |
Model name invoked |
Analyze model behavioral characteristics |
|
temperature |
Generation temperature parameter |
Analyze generation strategy |
Tool call information (security audit)
|
Data item |
Description |
Purpose |
|
tool_name |
Tool name invoked |
Detect malicious tool invocations |
|
tool_input |
Tool invocation input parameters |
Detect injection attacks and sensitive information |
|
tool_output |
Tool execution return result |
Detect information leakage |
|
execution_time |
Tool execution duration |
Analyze performance anomalies |
|
error_message |
Tool execution error information (if any) |
Detect abnormal behavior |
Data transmission details
|
Service endpoint |
Data type transmitted |
Transmission frequency |
Encryption method |
|
Management Server |
Device information, OpenClaw configuration |
Once at plugin startup, real-time on configuration changes |
HTTPS + TLS 1.2+ |
|
Protection Server |
LLM requests/responses, tool call information |
Real-time per request |
HTTPS + TLS 1.2+ |