AI-Warden — Prompt Injection Protection

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:17 AM UTC
• Version: 1.4.1

Overview

The setup is coherent for installing AI-Warden, but it can activate a broad security plugin and optional online scanning without enough detail about runtime data handling.

Review this before installing. Prefer offline mode unless you are comfortable with AI-Warden processing scanned agent content externally. If enabling API mode, look for clear endpoint, payload, redaction, retention, and logging documentation from the publisher. Install only from a trusted environment, inspect the npm package before activation, and keep the documented backup so OpenClaw config can be restored.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Error

• Location: SKILL.md:168
• Finding: Undeclared Runtime Transmission of Potentially Sensitive Agent Content<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:16-18`, `SKILL.md:33-34`, `SKILL.md:168-197`, `SKILL.md:258-261` **Vulnerability Type**: Sensitive data exposure through external API processing **Risk Level**: High ### Vulnerable Code Snippets ```yaml - name: AI_WARDEN_API_KEY required: false description: "Optional API key for online detection (98.9% accuracy)" ``` ```yaml permissions: network: true reason: "Fetches openclaw-ai-warden package from public npm registry during install" ``` ```markdown ### Step 5: Add API key (optional) For online detection (98.9% accuracy vs ~60% offline), add your API key. **Option A — Environment variable (recommended, key not stored in config file):** Set `AI_WARDEN_API_KEY` in your shell profile or systemd service: ```bash # For systemd (e.g., OpenClaw gateway service): # Add to your service override: Environment=AI_WARDEN_API_KEY=your_key_here # For shell: export AI_WARDEN_API_KEY=your_key_here ``` **Option B — Config file (simpler, key stored in openclaw.json):** ```bash node -e " const fs = require('fs'); const p = process.env.HOME + '/.openclaw/openclaw.json'; const cfg = JSON.parse(fs.readFileSync(p, 'utf8')); cfg.plugins.entries['ai-warden'].config.apiKey = 'YOUR_API_KEY_HERE'; fs.writeFileSync(p, JSON.stringify(cfg, null, 2)); // Restrict file permissions (config contains API key) fs.chmodSync(p, 0o600); console.log('API KEY ADDED (file permissions set to 600)'); " ``` ``` ```markdown | **File Shield** 🔴 | Poisoned files & web pages | `block` | Scans tool results, injects warning, triggers contamination lockdown on CRITICAL | | **Chat Shield** 🔴 | Injections in user messages | `warn` | Scans inbound messages, warns LLM | | **System Shield** ⬛ | Full context manipulation | `off` | Scans all messages (expensive, use sparingly) | | **Tool Shield** 🔴 | Malicious tool arguments | `block` | Blocks tool execution if arguments contain injection | ``` ### Technical Analysis The Skill enable ...[truncated 2951 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Clearly declare both installation-time and runtime network access in the Skill metadata. 2. Document the exact API hostname, request fields, authentication method, retention policy, processing location, and whether submitted data is used for model training. 3. Keep offline detection as the default and require explicit, informed opt-in before enabling external processing. 4. Perform local secret detection and redaction before any request leaves the host. At minimum, redact authorization headers, API keys, private keys, cookies, tokens, passwords, and known credential formats. 5. Provide controls to exclude sensitive channels, paths, tools, argument fields, and message classes from online scanning. 6. Minimize API payloads and transmit only the smallest content fragment necessary for classification. 7. Enforce a runtime network allowlist limited to the documented detection endpoint. 8. Prefer environment-based secret injection over storage in `openclaw.json`; ensure service definitions and shell profiles also have restrictive permissions. 9. Provide a verifiable no-network mode and logs that identify when external processing occurs without recording the sensitive payload. 10. Obtain user consent before transmitting messages, files, or tool data to the external service. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:79
• Finding: Third-Party Package Is Installed and Activated Without Independent Integrity Enforcement<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:79-119`, `SKILL.md:237-247` **Vulnerability Type**: Unsafe third-party dependency installation and activation **Risk Level**: Medium ### Vulnerable Code Snippet ```bash cd ~/.openclaw/extensions/ai-warden && npm install openclaw-ai-warden@2.4.0 ``` ```bash ls node_modules/openclaw-ai-warden/ ``` ```bash cat node_modules/openclaw-ai-warden/package.json | grep -E '"name"|"version"' ``` ```bash npm info openclaw-ai-warden repository.url ``` ```bash npm info openclaw-ai-warden dist.shasum ``` ```bash cat node_modules/openclaw-ai-warden/package.json | grep _shasum ``` ```bash cd ~/.openclaw/extensions/ai-warden ``` ```bash cp node_modules/openclaw-ai-warden/index.ts . ``` ```bash cp node_modules/openclaw-ai-warden/openclaw.plugin.json . ``` ```bash cp -r node_modules/openclaw-ai-warden/src . ``` The update procedure repeats the same installation and activation process: ```bash cd ~/.openclaw/extensions/ai-warden ``` ```bash npm install openclaw-ai-warden@2.4.0 ``` ```bash cp node_modules/openclaw-ai-warden/index.ts . ``` ```bash cp -r node_modules/openclaw-ai-warden/src . ``` ```bash openclaw gateway restart ``` ### Technical Analysis The Skill installs `openclaw-ai-warden@2.4.0` from npm, copies executable plugin source into the OpenClaw extension root, and restarts the gateway so that the downloaded code is loaded. Pinning the version limits accidental upgrades, but it does not protect against compromise of the corresponding package version before installation, registry-account compromise, or malicious package lifecycle scripts. The documented provenance procedure is not an independent integrity check: - `npm info ... dist.shasum` obtains metadata from the same registry supplying the package. - Reading `_shasum` from the installed package metadata does not establish trust independently of npm. - The instructions ask the user to compare values but do not automatically reject a misma ...[truncated 2498 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Vendor a reviewed source snapshot or package archive with the Skill so the exact executable code can be audited. 2. Publish and enforce an expected SHA-256 or stronger digest from an independently trusted source. Abort installation automatically if verification fails. 3. Use a lockfile committed after review and install with `npm ci` rather than a mutable dependency resolution process. 4. Initially install with `npm ci --ignore-scripts` or `npm install --ignore-scripts`, then separately review any lifecycle scripts before permitting them. 5. Verify npm provenance attestations or signed release artifacts where available. 6. Compare the package archive against a specific reviewed upstream commit rather than trusting only the repository URL in npm metadata. 7. Audit all transitive dependencies and reject unexpected dependency-tree changes. 8. Perform installation and inspection in a restricted staging environment before copying files into the live extension directory. 9. Run the gateway and plugin under a dedicated low-privilege account with narrowly scoped filesystem and network access. 10. Use atomic deployment and preserve a known-good extension snapshot so a compromised or defective release can be rolled back safely. ]]>

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrases are broad enough to match generic security and setup requests such as "security plugin" or "protect my agent," which can cause this skill to activate outside its intended scope. Because the skill performs installation and configuration actions with filesystem and network side effects, over-triggering increases the chance of inappropriate package installation or config modification during unrelated conversations.

Session Persistence

Medium

• Category: Rogue Agent

Content

**Verify:** Output is `BACKUP OK`.

### Step 1: Create extension directory

```bash
mkdir -p ~/.openclaw/extensions/ai-warden

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.