360 Secure SkillHub
360 安全技能中心

ZugaShield Security Scanner

该 Skill 是 OpenClaw 安全插件，通过 Gateway 钩子扫描消息、工具调用、响应和记忆，拦截提示注入、SSRF、命令注入、秘密/PII 泄露、DNS 外传和路径遍历；依赖 Python MCP 子进程，默认 fail-closed，工具调用始终 fail-closed，并提供状态与报告命令。

zuga-luga
zuga-luga
热度 60.59
最近更新 2026-05-11 17:26:07
分类：安全依赖：MCP 服务应用场景：工作流

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add zugashield
Metadata
name
zugashield
description
7-layer AI security scanner for OpenClaw. Blocks prompt injection, SSRF, command injection, data leakage, and memory poisoning across ALL channels (Signal, Telegram, Discord, WhatsApp, web) simultaneously.
metadata
{"openclaw":{"requires":{"env":[],"bins":["python"],"primaryModel":"any"},"permissions":["subprocess"]},"author":"Zuga-luga","license":"MIT","homepage":"https://github.com/Zuga-luga/ZugaShield","npm":"zugashield-openclaw-plugin"}

ZugaShield Security Scanner

7-layer AI security scanning plugin for OpenClaw. Protects all channels simultaneously by hooking into the Gateway — the single chokepoint for all traffic.

What It Blocks

Attack Hook Detection
Prompt injection preRequest 150+ signatures, unicode smuggling, encoding evasion
SSRF / Command injection preToolExecution Cloud metadata URLs, shell metacharacters (always fail-closed)
Secret / PII leakage preResponse API keys, tokens, credentials, high-entropy strings
Memory poisoning preRecall Embedded instructions, sleeper payloads in recalled memories
DNS exfiltration preResponse High-entropy subdomains, data-in-DNS patterns
Path traversal preToolExecution Directory traversal sequences, symlink attacks

Install

pip install "zugashield[mcp]"
npm install zugashield-openclaw-plugin
openclaw plugins install ./node_modules/zugashield-openclaw-plugin
openclaw restart

Verify

/shield status

Should show: CONNECTED with 7 active layers.

Configuration

In openclaw.json under plugins.entries.openclaw-plugin.config:

  • fail_closed (default: true) — Block requests when scanner is down
  • strict_mode (default: false) — Block medium+ threats (not just high/critical)
  • scan.inputs / scan.outputs / scan.tool_calls / scan.memory — Toggle individual hooks

How It Works

ZugaShield spawns a Python MCP server as a managed child process. Each message, tool call, and response passes through the scanner in <15ms. The plugin uses OpenClaw's Gateway hooks, meaning one install protects Signal + Telegram + Discord + WhatsApp + web simultaneously.

Tool calls are always fail-closed regardless of configuration — SSRF and command injection are too dangerous to allow through even temporarily.

Links