openclaw-bastion-pro

OpenClaw Bastion Pro

Everything in openclaw-bastion (free) plus automated countermeasures.

Free version alerts. Pro version subverts, quarantines, and defends.

Detection Commands (also in free)

python3 {baseDir}/scripts/bastion.py scan --workspace /path/to/workspace
python3 {baseDir}/scripts/bastion.py scan path/to/file.md --workspace /path/to/workspace
python3 {baseDir}/scripts/bastion.py check path/to/file.md --workspace /path/to/workspace
python3 {baseDir}/scripts/bastion.py boundaries --workspace /path/to/workspace
python3 {baseDir}/scripts/bastion.py allowlist --workspace /path/to/workspace
python3 {baseDir}/scripts/bastion.py status --workspace /path/to/workspace

Pro Countermeasures

Block Injection Patterns

Neutralize injection patterns in a file by wrapping them in warning comments. Creates a .bak backup first. Detected injection content is surrounded with <!-- [BLOCKED by openclaw-bastion-pro] --> markers.

python3 {baseDir}/scripts/bastion.py block path/to/file.md --workspace /path/to/workspace

Sanitize Hidden Unicode

Strip zero-width characters, RTL overrides, and hidden Unicode from files. Creates backups. Reports exactly what was removed and where.

python3 {baseDir}/scripts/bastion.py sanitize path/to/file.md --workspace /path/to/workspace
python3 {baseDir}/scripts/bastion.py sanitize path/to/directory/ --workspace /path/to/workspace

Quarantine Compromised Files

Move a file with injection patterns to .quarantine/bastion/ with evidence metadata. The file becomes inaccessible to the agent until explicitly restored.

python3 {baseDir}/scripts/bastion.py quarantine path/to/file.md --workspace /path/to/workspace

Unquarantine (Restore)

Restore a quarantined file to its original location after investigation.

python3 {baseDir}/scripts/bastion.py unquarantine path/to/file.md --workspace /path/to/workspace

Deploy Canary Tokens

Deploy unique canary strings into monitored files. If an injection attack reads and exfiltrates these files, the canary token appears in the leaked data, proving the attack. Tokens are tracked in a secure manifest.

python3 {baseDir}/scripts/bastion.py canary --workspace /path/to/workspace
python3 {baseDir}/scripts/bastion.py canary path/to/specific/file.md --workspace /path/to/workspace

Enforce via Hooks

Generate a Claude Code hook configuration that runs bastion scan on file reads (PreToolUse hook for Read tool) and validates commands against the policy (PreToolUse hook for Bash tool). Also adds a SessionStart hook for automated protection sweeps.

python3 {baseDir}/scripts/bastion.py enforce --workspace /path/to/workspace

Protect (Full Automated Sweep)

Full automated defense sweep: scan all files, sanitize hidden Unicode, quarantine files with CRITICAL injections, deploy canary tokens, and report. This is the recommended command for session startup.

python3 {baseDir}/scripts/bastion.py protect --workspace /path/to/workspace

Recommended Integration

Session Startup Hook (Claude Code)

{
  "hooks": {
    "SessionStart": [
      {
        "hooks": [
          {
            "type": "command",
            "command": "python3 scripts/bastion.py protect",
            "timeout": 60
          }
        ]
      }
    ]
  }
}

Heartbeat (OpenClaw)

Add to HEARTBEAT.md for periodic protection:

- Run injection defense sweep (python3 {skill:openclaw-bastion-pro}/scripts/bastion.py protect)

What Gets Detected

Category	Patterns	Severity
Instruction override	"ignore previous", "disregard above", "you are now", "new system prompt", "forget your instructions", "override safety", "entering developer mode"	CRITICAL
System prompt markers	<system>, [SYSTEM], <<SYS>>, <|im_start|>system, [INST], ### System:	CRITICAL
Hidden instructions	Multi-turn manipulation, stealth patterns ("do not tell the user")	CRITICAL
HTML injection	<script>, <iframe>, <img onerror=>, hidden divs	CRITICAL
Markdown exfiltration	Image tags with encoded data in URLs	CRITICAL
Dangerous commands	curl | bash, wget | sh, rm -rf /, fork bombs	CRITICAL
Unicode tricks	Zero-width characters, RTL overrides, invisible formatting	WARNING
Homoglyphs	Cyrillic/Latin lookalikes mixed into ASCII text	WARNING
Base64 payloads	Large encoded blobs outside code blocks	WARNING
Shell injection	$(command) subshell execution outside code blocks	WARNING
Delimiter confusion	Fake code block boundaries with injection content	WARNING

Exit Codes

Code	Meaning
0	Clean, no issues
1	Warnings detected (review recommended)
2	Critical findings (action needed)

No External Dependencies

Python standard library only. No pip install. No network calls. Everything runs locally.

Cross-Platform

Works with OpenClaw, Claude Code, Cursor, and any tool using the Agent Skills specification.