AI Agent OPSEC — Runtime Classified Data Enforcer

This skill appears to do what it says — local redaction and an append-only audit log with no network calls — but do not assume it protects you out of the box. Before installing or relying on it: 1) Populate externalAgents/internalAgents (or otherwise integrate sanitizeOutbound/redactTaskBeforeSpawn) — by default the externalAgents list is empty, so the enforcer will NOT block agent spawns unless you configure it. 2) Create classified/classified-terms.md and add your terms; check the regex behavior (proper-noun vs case-insensitive rules) to ensure it matches your terms as intended. 3) Protect the audit log: add classified/ and memory/security/ to .gitignore and restrict filesystem permissions on memory/security to prevent unauthorized access. 4) Review the source yourself (or with a trusted reviewer) — the module runs locally and writes files, so confirm its behavior fits your threat model. 5) Test thoroughly (use the included CLI/test) before using in production agents and consider additional safeguards (workspace isolation, process sandboxing, or containerization) for high-value classified data.

These patterns were detected by automated regex scanning. They may be normal for skills that integrate with external APIs. Check the VirusTotal and OpenClaw results above for context-aware analysis.