Runtime Security Guard - Enterprise AI Runtime Protection

🛡️ 410+ Security Rules | 10 Threat Categories + OpenClaw-Specific + IM Bot Security | Web Dashboard | Automated Testing | Fully Local

What's New in v2.1.0 (2026-03-26):

• 14 new OpenClaw configuration-level security detection rules (openclaw-100 to openclaw-113)
• Enhanced OpenClaw 2026.3.x version-specific threat detection
• New critical configuration checks: Control UI auth, rate limiting, multi-user isolation
• Improved monitoring for ACP runtime, Canvas A2UI, model overrides

From v2.0.0:

• 32 OpenClaw-specific threat detection rules (based on MITRE ATLAS framework)
• 33 IM bot plugin security rules (QQBot/Telegram/WhatsApp/Discord)

🎯 Features

Core Security Capabilities

• ✅ Prompt Injection Detection - 26 rules, identifies jailbreaks, hidden instructions, system prompt theft
• ✅ Data Exfiltration Protection - 22 rules, prevents sensitive data transmission, memory access
• ✅ Malicious Command Interception - 24 rules, detects deletion, download-exec, reverse shells
• ✅ Sensitive Data Protection - 24 rules, identifies API keys, passwords, personal information
• ✅ Social Engineering Defense - 23 rules, identifies urgency manipulation, authority impersonation
• ✅ Supply Chain Attack Detection - 25 rules, detects malicious dependencies, build script injection
• ✅ Zero-Day Vulnerability Identification - 20 rules, identifies memory corruption, code execution
• ✅ APT Attack Detection - 30 rules, detects reconnaissance, persistence, lateral movement
• ✅ Insider Threat Identification - 27 rules, identifies abnormal access, privilege abuse
• ✅ OpenClaw Configuration Security - 14 rules, detects dangerous config flags (NEW in v2.1.0)

Technical Advantages

• ✅ Fully Local Execution - No cloud API required, data stays local
• ✅ Zero Quota Limits - Unlimited detection usage
• ✅ High Performance - Average detection latency < 20ms, cache hit < 1ms
• ✅ Web Monitoring Dashboard - Real-time alerts, performance metrics, config management
• ✅ Automated Testing - 35+ test cases, 100% pass rate
• ✅ Easy Integration - OpenClaw native skill, out-of-the-box

📦 Installation

Method 1: Install from ClawHub (Recommended)

# Search for the skill
clawhub search runtime-security-guard

# Install the skill
clawhub install runtime-security-guard

# Verify installation
openclaw skills list | grep runtime-security

Method 2: Quick Install without sudo (Recommended)

# Download and run installation script
curl -fsSL https://raw.githubusercontent.com/nanlin300624/runtime-security-guard/main/install-no-sudo.sh | bash

# Or manually download
wget https://raw.githubusercontent.com/nanlin300624/runtime-security-guard/main/install-no-sudo.sh
chmod +x install-no-sudo.sh
./install-no-sudo.sh

Features:

• ✅ No sudo privileges required
• ✅ User-level installation
• ✅ Automatic environment detection
• ✅ Multiple download methods (Git/curl/wget)
• ✅ Automatic environment variable configuration

Method 3: Install from Source

# Clone the repository
git clone https://github.com/nanlin300624/runtime-security-guard.git
cd runtime-security-guard

# Install dependencies
npm install

# Build the project
npm run build

# Copy to OpenClaw skills directory
cp -r . ~/.openclaw/workspace/skills/runtime-security-guard/

Method 4: Direct Package Installation

# Download the skill package
wget https://github.com/nanlin300624/runtime-security-guard/releases/latest/download/runtime-security-guard.zip

# Extract to skills directory
unzip runtime-security-guard.zip -d ~/.openclaw/workspace/skills/

🚀 Quick Start

Basic Usage

The skill runs automatically after installation, no additional configuration required:

// In OpenClaw, all file reads, tool results, and user inputs are automatically detected

Start Web Monitoring

# Start web server (default port 3000)
npm run web

# Access monitoring dashboard
# http://localhost:3000

Run Tests

# Run quick functional tests
npm run test:quick

# Run unit tests
npm test

# Run all tests
npm run test:all

📊 Monitoring Dashboard Features

Real-time Dashboard

• 📊 Total alerts
• 🚨 CRITICAL level alerts
• ⚠️ HIGH level alerts
• ⏱️ Average detection latency
• 💾 Cache hit rate
• ✅ Health status

Alert Visualization

• Alert type distribution (10 categories)
• Severity distribution (CRITICAL/HIGH/MEDIUM/LOW)
• Recent alerts list (time, event, type, severity, action)

Performance Metrics

• P95 latency
• P99 latency
• Max latency
• Memory usage

Configuration Management

• Detection threshold (0.0-1.0)
• Cache TTL (seconds)
• Save configuration online

🔌 API Endpoints

Get Statistics

curl http://localhost:3000/api/stats

Response Example:

{
  "total": 156,
  "byType": {
    "PROMPT_INJECTION": 45,
    "DATA_EXFILTRATION": 32
  },
  "bySeverity": {
    "CRITICAL": 12,
    "HIGH": 54,
    "MEDIUM": 67,
    "LOW": 23
  },
  "timeRange": {
    "start": "2026-03-07T12:00:00.000Z",
    "end": "2026-03-07T13:30:00.000Z"
  }
}

Get Alert List

curl http://localhost:3000/api/alerts?limit=50

Get Performance Metrics

curl http://localhost:3000/api/performance

Health Check

curl http://localhost:3000/api/health

⚙️ Configuration Options

Detection Threshold

// Risk threshold (0.0-1.0)
// Default: 0.6
// Content below this value won't be marked as risky

Cache Configuration

// Cache TTL (milliseconds)
// Default: 60000 (60 seconds)
// Cached content expires after this duration

// Maximum cache entries
// Default: 1000 entries

Performance Optimization

// Pre-compiled regex - automatically compiled at startup
// Dual-layer cache - RuleEngine + DetectorManager
// Priority execution - CRITICAL → HIGH → MEDIUM → LOW
// Fast-fail - CRITICAL rules return immediately on match

🧪 Testing System

Test Types

Running Tests

# Quick functional tests
npm run test:quick

# Unit tests
npm test

# Stress tests
npm run test:stress

# Coverage tests
npm run test:coverage

# All tests
npm run test:all

📈 Performance Benchmarks

Detection Latency

Concurrency Performance

Memory Usage

🛠️ Development Guide

Adding New Rules

1. Create or edit rule files in src/rules/patterns/
2. Import new rules in src/rules/rule-engine.ts
3. Run tests to verify
4. Update coverage tests

Custom Alerts

import { plugin } from './runtime-security-guard';

// Get alert statistics
const stats = await plugin.getStats();

// Health check
const health = plugin.healthCheck();

// Performance report
const report = plugin.getPerformanceReport();

Integration with Monitoring Systems

import { RuntimeSecurityGuard } from './runtime-security-guard';

const guard = new RuntimeSecurityGuard();

// Start web monitoring
await guard.startWebServer(3000);

// Real-time alert monitoring
guard.alerter.startMonitoring((alert) => {
  console.log('New alert:', alert);
});

📚 Documentation

🤝 Support

Issue Reporting

• GitHub Issues: https://github.com/nanlin300624/runtime-security-guard/issues
• Email: nanlin@outlook.com

Community

• Discord: https://discord.gg/clawd
• OpenClaw Forum: https://forum.openclaw.ai

📝 Changelog

v2.1.0 (2026-03-26)

Added:

• ✅ 14 OpenClaw configuration-level security detection rules (openclaw-100 to openclaw-113)
• ✅ Enhanced OpenClaw 2026.3.x version-specific threat detection
• ✅ New critical configuration checks: Control UI auth, rate limiting, multi-user isolation
• ✅ Improved monitoring for ACP runtime, Canvas A2UI, model overrides

Security:

• ✅ Enhanced Control UI security configuration detection
• ✅ Enhanced multi-user environment trust boundary detection
• ✅ Enhanced ACP runtime privilege escalation detection

v2.0.0 (2026-03-09)

Added:

• ✅ Cross-platform support (Windows/Linux/macOS)
• ✅ 110 platform-specific rules
  • Windows: 60 rules (PowerShell, Batch, Registry)
  • Linux: 50 rules (Shell, Cron, Systemd)
  • macOS: 28 rules (AppleScript, LaunchAgents, Permissions)
• ✅ File integrity monitoring module
• ✅ Network connection monitoring module
• ✅ Process behavior monitoring module
• ✅ Cross-platform compatibility tests

Changed:

• ✅ Optimized rule engine with dynamic platform loading
• ✅ Improved initialization performance (20ms → 18ms)
• ✅ Updated attack detection rate (70% → 75%)
• ✅ Refactored TypeScript strict mode

Fixed:

• ✅ Fixed rule type compatibility issues
• ✅ Fixed partial platform detection failures

Security:

• ✅ Enhanced C2 server detection capability
• ✅ Enhanced port scan detection capability

v1.1.0 (2026-03-07)

Added:

• ✅ Web real-time monitoring interface
• ✅ SSE real-time data push
• ✅ Automated testing system
• ✅ Performance monitoring and health checks
• ✅ 35+ test cases

Performance:

• ✅ Pre-compiled regex cache (221 rules)
• ✅ Grouped execution by severity
• ✅ Dual-layer cache mechanism
• ✅ Fast-fail mechanism

v1.0.0 (2026-03-07)

Initial Release:

• ✅ 221 security rules
• ✅ 9 threat categories
• ✅ Fully local execution
• ✅ Zero quota limits

📄 License

MIT License - See LICENSE file

🎉 Acknowledgments

Thanks to the following projects for inspiration:

• OpenClaw - AI assistant framework
• OpenGuardrails - Security monitoring concepts
• MITRE ATT&CK - Threat classification reference

Made with ❤️ by nanlin@outlook.com

Secure AI usage starts with Runtime Security Guard! 🦞🛡️