safe-openclaw

Permission-based access control for AI tool calls

Security Shield monitors all tool calls for dangerous commands and secret leaks. It automatically blocks destructive operations (rm -rf, reverse shells, crypto mining) and redacts API keys/tokens from tool output before they reach the conversation. All tool activity is logged to ~/.openclaw/security-audit.jsonl for audit review.