Security Shield is a security skill for OpenClaw agents. We take security issues seriously.

Please DO NOT open a public GitHub issue for security vulnerabilities.

Instead, report privately via:

1. GitHub Private Vulnerability Reporting: Go to Security Advisories and click "Report a vulnerability"
2. Or email: Create a GitHub issue with [SECURITY] prefix and we'll reach out privately

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

This skill follows these security practices:

1. No pattern strings - We use abstract descriptions, not specific strings that could be targeted
2. Defense in depth - Multiple overlapping protections
3. Least privilege - The skill only guides behavior, never executes commands
4. Transparency - All security decisions are explained to the user

• Security Shield guides agent behavior but cannot override compromised agent instructions
• The skill does not scan other skills for malware (use Skill Vetter for that)
• Security events are recorded via threat-handling rules in SKILL.md: events are written to memory/YYYY-MM-DD.md (event metadata only - never raw payloads). Quarantined files go to $HOME/.security-shield/quarantine/ (requires user approval first). The skill does NOT write to host system logs (syslog, journald, etc.); all event recording is within the agent's own workspace.
• During an explicitly requested full-system check, the agent may inspect local state within the agreed scope (see USAGE-GUIDE.md)

• OpenClaw Security Best Practices
• ClawHub Security Guidelines
• Skill Vetter - Scan skills before installation