Permission Guard

A runtime security watchdog for OpenClaw agents. Its purpose is to give users clear visibility into what their installed skills are actually doing — catching unexpected file access, suspicious network calls, dangerous commands, or behavior that goes beyond a skill's declared purpose.

Behavior Log

Maintain a running log at ~/.openclaw/permission-guard.log. Record each notable agent action in this format:

[ISO-8601 timestamp] SKILL:[skill-name] ACTION:[file|network|command] TARGET:[path/url/cmd] STATUS:[ok|flagged|blocked]

Keep log files under 10MB — rotate monthly by renaming the old file to permission-guard.log.YYYY-MM. The log stays local and is never transmitted externally.

Security Checks

Run all four checks when producing a report, then summarize findings together.

Check 1 — Sensitive File Access

Look for recent touches to credential and configuration files:

find ~ -newer ~/.openclaw/last-check -type f 2>/dev/null \
  | grep -E '(\.ssh|\.aws|\.gnupg|\.config/gcloud|\.gitconfig|/etc/passwd|/etc/shadow|Library/Keychains|\.config/google-chrome|\.mozilla)' \
  | head -30
# Update timestamp after check:
touch ~/.openclaw/last-check

Flag any match. The risk is concrete: a rogue skill reading ~/.ssh/id_rsa while appearing to do something routine is a classic credential exfiltration path.

Check 2 — Outbound Network Connections

Review active and recent connections:

ss -tnp 2>/dev/null | grep -Ev '(127\.0\.0\.1|::1|LISTEN)'

Flag connections to:

• Unrecognized IPs or domains not associated with the skill's declared APIs
• Known data-sharing services (pastebin, webhook.site, file-sharing hosts)
• Any plaintext (non-HTTPS) connection carrying data

Check 3 — Dangerous Command Patterns

Check the log for commands that signal permission abuse:

grep -E '(rm\s+-rf|chmod\s+777|curl.+\|\s*(ba)?sh|wget.+\|\s*(ba)?sh|crontab\s+-[el]|useradd|sudo\b)' \
  ~/.openclaw/permission-guard.log 2>/dev/null | tail -20

These patterns don't automatically mean malicious intent, but each warrants a prompt explanation to the user before proceeding.

Check 4 — Behavioral Drift

Compare what a skill actually did against what its name and description promise. The principle: a skill should only do what its declared purpose suggests.

Examples worth flagging:

• A "weather" skill writing to the filesystem
• An "email" skill accessing SSH keys
• A "calendar" skill running arbitrary shell commands
• Any skill POSTing data to a URL not listed in its declared API set

Output Format

Produce this report structure, omitting sections that have no events:

🛡️ Permission Guard — Activity Report
════════════════════════════════════════
Period: [start] → [end]
Skills monitored: [N]

✅ Normal Activity ([X] events)
   [skill-name]: [description of expected action]