- name
- openclaw-snitch
- version
- 1.0.0
- description
- >
- metadata
- openclaw
- emoji
- 🚨
- events
openclaw-snitch
A configurable blocklist guard for OpenClaw with three enforcement layers:
- Bootstrap directive — injects a security policy into every agent context
- Message warning — flags incoming messages referencing blocked terms
- Hard block — intercepts and kills the tool call + broadcasts a Telegram alert
Install
Hooks (bootstrap + message guard)
After installing this skill, copy the hook directories into your workspace:
cp -r ~/.openclaw/workspace/skills/openclaw-snitch/hooks/snitch-bootstrap ~/.openclaw/hooks/snitch-bootstrap
cp -r ~/.openclaw/workspace/skills/openclaw-snitch/hooks/snitch-message-guard ~/.openclaw/hooks/snitch-message-guardThen enable them in openclaw.json:
{
"hooks": {
"snitch-bootstrap": { "enabled": true },
"snitch-message-guard": { "enabled": true }
}
}Plugin (hard block + Telegram alert)
For the hard enforcement layer, install the npm package:
npm install -g openclaw-snitchThen add to openclaw.json:
{
"plugins": {
"allow": ["openclaw-snitch"]
}
}Lock down the plugin files after install so the agent can't self-modify:
chmod -R a-w ~/.openclaw/extensions/openclaw-snitchConfiguration
In openclaw.json under plugins.config.openclaw-snitch:
{
"plugins": {
"config": {
"openclaw-snitch": {
"blocklist": ["clawhub", "clawdhub"],
"alertTelegram": true,
"bootstrapDirective": true
}
}
}
}| Key | Default | Description |
|---|---|---|
blocklist | ["clawhub", "clawdhub"] | Terms to block (case-insensitive word boundary match) |
alertTelegram | true | Broadcast Telegram alert to all allowFrom IDs on block |
bootstrapDirective | true | Inject security directive into every agent bootstrap context |
Hook blocklist (env var)
The hooks read SNITCH_BLOCKLIST (comma-separated) if set, otherwise fall back to the defaults:
SNITCH_BLOCKLIST=clawhub,clawdhub,myothertoolWhat gets blocked
Blocks fire when the tool name or tool parameters contain a blocked term. This catches cases where an agent tries to invoke a blocked tool indirectly (e.g. exec with clawhub install in the args).
Security notes
- The hooks in
~/.openclaw/hooks/load unconditionally — most tamper-resistant layer - The plugin layer requires
plugins.allow— if an agent editsopenclaw.json, hooks remain active chown root:rooton the extension dir prevents the agent from self-modifying the plugin