arc-shield

What This Skill Does

Arc-shield serves as the final line of defense for OpenClaw agents by providing real-time output sanitization. Unlike input filters that scan incoming data, arc-shield inspects outbound messages—ensuring that your agent does not accidentally leak sensitive credentials, PII, or internal tokens to external channels like Discord, Slack, or web interfaces. It performs deep analysis on message payloads, using both pattern matching for known key structures (OpenAI keys, AWS secrets, private keys) and high-entropy detection to identify anomalous strings that suggest hidden credentials. In --strict mode, the agent will block any transmission containing a high-risk secret, while the --redact flag allows the agent to scrub the specific sensitive token from the message while keeping the rest of the context intact.

Installation

To install arc-shield, navigate to your skill directory and clone the repository:

cd ~/.openclaw/workspace/skills git clone <arc-shield-repo> arc-shield chmod +x arc-shield/scripts/*.sh arc-shield/scripts/*.py

Alternatively, use the clawhub command for seamless integration: clawhub install openclaw/skills/skills/arc-claw-bot/arc-shield

Use Cases

Arc-shield is critical for developers who leverage AI agents for debugging or automation. Common use cases include:

• Log Sanitization: Automatically strip secrets from raw log files before sending them to a support channel.
• Code Review: Ensure that AI-generated code snippets do not contain real API keys or database connection strings.
• Policy Enforcement: Block the transmission of sensitive data like social security numbers or credit cards in customer-facing communication channels.
• Credential Leak Prevention: Catch unintentional pastes of environment variables when an agent displays its current configuration during troubleshooting.

Example Prompts

1. "Scan this log output for any AWS tokens or hardcoded database passwords before sending to the team Slack channel."
2. "Redact any sensitive API keys from the generated code output in the response and send the result to the repository manager."
3. "Run a strict check on the current session summary to ensure no PII or credit card numbers are included before finalizing the report."

Tips & Limitations

• Strict vs. Redact: Always use --strict in automated production pipelines to ensure no message is sent if a leak is detected. Use --redact for interactive sessions where you want to maintain the flow of conversation.
• False Positives: High-entropy detection might occasionally flag safe strings. If you experience frequent blocking, consider fine-tuning your local ignore-list in the config file.
• Not an Input Filter: Remember that arc-shield does not protect against malicious incoming requests; it is exclusively an output guard. Use it in conjunction with clawdefender for full-stack security.