{"_id":"@cyberdyne-systems/agent-safety","_rev":"10-4a7a5d3965d49fd453969f328b009dbd","name":"@cyberdyne-systems/agent-safety","dist-tags":{"latest":"2026.3.15"},"versions":{"2026.3.3":{"name":"@cyberdyne-systems/agent-safety","version":"2026.3.3","_id":"@cyberdyne-systems/agent-safety@2026.3.3","maintainers":[{"name":"cluster2600","email":"cluster2600@gmail.com"}],"dist":{"shasum":"d8fa8b20c59ffc9d2401dbb361b41f8ed74b8c12","tarball":"https://registry.npmjs.org/@cyberdyne-systems/agent-safety/-/agent-safety-2026.3.3.tgz","fileCount":13,"integrity":"sha512-Mbni8OKVonuglkfY/3AQI74J6lvEWkb/bCsr0gsADfxGB2v615J51gdKmYqS7fb46KEo2V93vaaKvQlrRqCyAg==","signatures":[{"sig":"MEYCIQD7Gbp1Beg4js/dShRa/HA+atplrMQUhbDtgaTbxGm6RQIhAJFbO3+7uS4Yuc7cFQBfabcefSG2RfiN/xUfKDUJ3oDJ","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":81702},"type":"module","gitHead":"b21b53c2c4d7f4d2a988a41c7b14aa171a95c256","_npmUser":{"name":"cluster2600","email":"cluster2600@gmail.com"},"openclaw":{"extensions":["./index.ts"]},"_npmVersion":"11.10.1","description":"Agent safety system: stakeholder model, action validator, and safety dashboard — based on arXiv:2602.20021","directories":{},"_nodeVersion":"25.7.0","dependencies":{"@sinclair/typebox":"0.34.48"},"_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/agent-safety_2026.3.3_1772880533633_0.9389394092284049","host":"s3://npm-registry-packages-npm-production"}},"2026.3.7":{"name":"@cyberdyne-systems/agent-safety","version":"2026.3.7","_id":"@cyberdyne-systems/agent-safety@2026.3.7","maintainers":[{"name":"cluster2600","email":"cluster2600@gmail.com"}],"dist":{"shasum":"fc65a6b5d0eff9aebbc2883cf85956e35521efbf","tarball":"https://registry.npmjs.org/@cyberdyne-systems/agent-safety/-/agent-safety-2026.3.7.tgz","fileCount":13,"integrity":"sha512-XZKIEYy9KUYvBOjIfWb2fX066wvg+3yODH+eCE/LorFR9pVIYtXLEJvZfXOyTWZSrv3YXLPohmwvpKkhZ5W1wQ==","signatures":[{"sig":"MEYCIQCp1VjuF5viPUBzBElCvj0HRcTrSRHNNU2iBRLZiKSEZwIhAJ8jI5fU1xvxDKtb9t95YHvJIBgTJBeSxTj+XnsCKDZH","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":81968},"type":"module","gitHead":"0b648717f7c0b999c441a226e4d0f8fbe8bb0afb","_npmUser":{"name":"cluster2600","email":"cluster2600@gmail.com"},"openclaw":{"extensions":["./index.ts"]},"_npmVersion":"11.10.1","description":"Agent safety system: stakeholder model, action validator, and safety dashboard — based on arXiv:2602.20021","directories":{},"_nodeVersion":"25.7.0","dependencies":{"@sinclair/typebox":"0.34.48"},"_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/agent-safety_2026.3.7_1772881676061_0.5290543760465773","host":"s3://npm-registry-packages-npm-production"}},"2026.3.8":{"name":"@cyberdyne-systems/agent-safety","version":"2026.3.8","_id":"@cyberdyne-systems/agent-safety@2026.3.8","maintainers":[{"name":"cluster2600","email":"cluster2600@gmail.com"}],"dist":{"shasum":"3b3f934795622f599a14c80a6926dad65b8ad44f","tarball":"https://registry.npmjs.org/@cyberdyne-systems/agent-safety/-/agent-safety-2026.3.8.tgz","fileCount":13,"integrity":"sha512-ejgFNKZ4Gs2E+5oqEdnQHWHmOCG05kqYUS9RKAnMlQYUW4PRz+RLiBxXXfFg4Kjt5dN/yowmN6mgoI+rZcX9Mg==","signatures":[{"sig":"MEYCIQDnYkEMASdsYaBmLQO/vN6Dk1Av5JQFwmr67m1nsHCZwgIhAIkwK1e1aZhYpTCkhxaOwcySALg3zDRaX0kMO9hB+s9w","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":83259},"type":"module","_npmUser":{"name":"cluster2600","email":"cluster2600@gmail.com"},"openclaw":{"extensions":["./index.ts"]},"_npmVersion":"11.10.1","description":"Agent safety system: stakeholder model, action validator, and safety dashboard — based on arXiv:2602.20021","directories":{},"_nodeVersion":"25.7.0","dependencies":{"@sinclair/typebox":"0.34.48"},"_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/agent-safety_2026.3.8_1772884386718_0.8622779709587995","host":"s3://npm-registry-packages-npm-production"}},"2026.3.9":{"name":"@cyberdyne-systems/agent-safety","version":"2026.3.9","_id":"@cyberdyne-systems/agent-safety@2026.3.9","maintainers":[{"name":"cluster2600","email":"cluster2600@gmail.com"}],"dist":{"shasum":"7921311c957e6b42e263f81e0413ac05634a7a5d","tarball":"https://registry.npmjs.org/@cyberdyne-systems/agent-safety/-/agent-safety-2026.3.9.tgz","fileCount":13,"integrity":"sha512-h0CW6soVyRIXIRo95II0J0+jzna6+jUo/4fw8LP0W2F+QtGs+qRlVhc4xbvHwrsdhnzHAEknF3tTBylqmf8sKQ==","signatures":[{"sig":"MEQCIDrHhVIz2/1zu7tOSMnNK1Whdndp65dA8a8nF1VwEBhUAiArueMpcpTmPG6jATSqNAuJcoudli+7OVvkpjJPjYxR5w==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":89092},"type":"module","_npmUser":{"name":"cluster2600","email":"cluster2600@gmail.com"},"openclaw":{"extensions":["./index.ts"]},"_npmVersion":"11.10.1","description":"Agent safety system: stakeholder model, action validator, and safety dashboard — based on arXiv:2602.20021","directories":{},"_nodeVersion":"25.7.0","dependencies":{"@sinclair/typebox":"0.34.48"},"_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/agent-safety_2026.3.9_1772884776196_0.7370947649998079","host":"s3://npm-registry-packages-npm-production"}},"2026.3.10":{"name":"@cyberdyne-systems/agent-safety","version":"2026.3.10","keywords":["openclaw","agent-safety","llm","security","stakeholder","trust","validation","arxiv-2602-20021"],"license":"MIT","_id":"@cyberdyne-systems/agent-safety@2026.3.10","maintainers":[{"name":"cluster2600","email":"cluster2600@gmail.com"}],"homepage":"https://github.com/cluster2600/agent-safety#readme","bugs":{"url":"https://github.com/cluster2600/agent-safety/issues"},"dist":{"shasum":"a458a3d9c7510e2a3eba2d6e35897d086beeeb5c","tarball":"https://registry.npmjs.org/@cyberdyne-systems/agent-safety/-/agent-safety-2026.3.10.tgz","fileCount":15,"integrity":"sha512-ANcTePyTYMPdF2iS23VDPvMdFSZUQoDKpbS+f+3dSDO71aJ4xTK0SQfqFPUfphnw/cV7tHdkUpnXqjOW9ctzhw==","signatures":[{"sig":"MEUCIQD3zcragg1qCJRFQ0S0pNBgqCAjCE2E3hITO+//aYRpQwIgYRCxwdrxE5c5GgFYRStLw8kBPpJ/6hpFO798wNzcbFk=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":98223},"type":"module","gitHead":"217bed37af2f9d14d90869b1c343dd5de033c627","_npmUser":{"name":"cluster2600","email":"cluster2600@gmail.com"},"openclaw":{"extensions":["./index.ts"]},"repository":{"url":"git+https://github.com/cluster2600/agent-safety.git","type":"git"},"_npmVersion":"11.10.1","description":"Agent safety system: stakeholder model, action validator, and safety dashboard — based on arXiv:2602.20021","directories":{},"_nodeVersion":"25.7.0","dependencies":{"@sinclair/typebox":"0.34.48"},"_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/agent-safety_2026.3.10_1772885269529_0.09219803801631121","host":"s3://npm-registry-packages-npm-production"}},"2026.3.11":{"name":"@cyberdyne-systems/agent-safety","version":"2026.3.11","_id":"@cyberdyne-systems/agent-safety@2026.3.11","maintainers":[{"name":"cluster2600","email":"cluster2600@gmail.com"}],"dist":{"shasum":"4d730b972da243bef7299d1ed9b485e35ac25c46","tarball":"https://registry.npmjs.org/@cyberdyne-systems/agent-safety/-/agent-safety-2026.3.11.tgz","fileCount":14,"integrity":"sha512-V0gGw7pc8mhDcL50vcda1iHPUxECF2izs7goHi1jbYNoBdDkSqEZvMC7iTH+Y4T5LfxGt1sW3hEM0tB5DQlQLQ==","signatures":[{"sig":"MEYCIQDzYDk1WB1o18hD3SXJO7J4hsDO18N2ntEvp7ZpKIoWWwIhAKphsEAhkgc3fG9dF50rvV6KNe+jwhqovE9M/ENFj4cq","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":98095},"type":"module","_npmUser":{"name":"cluster2600","email":"cluster2600@gmail.com"},"openclaw":{"extensions":["./index.ts"]},"_npmVersion":"11.10.1","description":"Agent safety system: stakeholder model, action validator, and safety dashboard — based on arXiv:2602.20021","directories":{},"_nodeVersion":"25.7.0","dependencies":{"@sinclair/typebox":"0.34.48"},"_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/agent-safety_2026.3.11_1772885815502_0.03505943756063368","host":"s3://npm-registry-packages-npm-production"}},"2026.3.12":{"name":"@cyberdyne-systems/agent-safety","version":"2026.3.12","_id":"@cyberdyne-systems/agent-safety@2026.3.12","maintainers":[{"name":"cluster2600","email":"cluster2600@gmail.com"}],"dist":{"shasum":"fde83e56fe4ceb5a564762acf327e6f72f719bce","tarball":"https://registry.npmjs.org/@cyberdyne-systems/agent-safety/-/agent-safety-2026.3.12.tgz","fileCount":14,"integrity":"sha512-IROp2ol3W50bO6iOzpzhRC7OwnukgorhgxlE7IPeKbGlBmTaKb2Vvos9PwitXysqgGkNWy2t+vx0LvrRpXrELw==","signatures":[{"sig":"MEQCICiIV9f5t716jy88B2kR3YtEKPn9M455zbgavlgF8pjfAiA9Hg3zvHWxwoT0SxEnqqZxXl4Czdu40eM4Z6dmuwrLnw==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":114455},"type":"module","gitHead":"03c258f6746fe871b560dc95fd3328bd4a51d7d7","_npmUser":{"name":"cluster2600","email":"cluster2600@gmail.com"},"openclaw":{"extensions":["./index.ts"]},"_npmVersion":"11.10.1","description":"Agent safety system: stakeholder model, action validator, and safety dashboard — based on arXiv:2602.20021","directories":{},"_nodeVersion":"25.7.0","dependencies":{"@sinclair/typebox":"0.34.48"},"_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/agent-safety_2026.3.12_1772901736776_0.4184490811890771","host":"s3://npm-registry-packages-npm-production"}},"2026.3.13":{"name":"@cyberdyne-systems/agent-safety","version":"2026.3.13","_id":"@cyberdyne-systems/agent-safety@2026.3.13","maintainers":[{"name":"cluster2600","email":"cluster2600@gmail.com"}],"dist":{"shasum":"c17b34aee8a78653f438cc99386dcd469acf413f","tarball":"https://registry.npmjs.org/@cyberdyne-systems/agent-safety/-/agent-safety-2026.3.13.tgz","fileCount":14,"integrity":"sha512-VS92S43Dgry2HygNZpCYippvXjsWZNvVKrFYc5ZDDg6RydRBD0hYSMuKj5KBk6sfF32fY+o3z5tt3zVX5U8Ehw==","signatures":[{"sig":"MEUCIQD01u//0Hcpkjri5mH+qWNpfbymPlc79SChpPznnyfTngIgTmRVMY9WCk7zdALWwJnJLS13E6aPRUXrYQmW+q+Aut4=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":114746},"type":"module","gitHead":"391d431f35ec2e57dc9e7d5e3e72bb4ce79b37a5","_npmUser":{"name":"cluster2600","email":"cluster2600@gmail.com"},"openclaw":{"extensions":["./index.ts"]},"_npmVersion":"11.10.1","description":"Agent safety system: stakeholder model, action validator, and safety dashboard — based on arXiv:2602.20021","directories":{},"_nodeVersion":"25.7.0","dependencies":{"@sinclair/typebox":"0.34.48"},"_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/agent-safety_2026.3.13_1772904106939_0.31309827113254873","host":"s3://npm-registry-packages-npm-production"}},"2026.3.14":{"name":"@cyberdyne-systems/agent-safety","version":"2026.3.14","_id":"@cyberdyne-systems/agent-safety@2026.3.14","maintainers":[{"name":"cluster2600","email":"cluster2600@gmail.com"}],"dist":{"shasum":"3ecae79168541018fc5477cc1df277a226ca3c3b","tarball":"https://registry.npmjs.org/@cyberdyne-systems/agent-safety/-/agent-safety-2026.3.14.tgz","fileCount":14,"integrity":"sha512-K9aAex8Kqlz6Trppd5AUiYOsdZE/O4PBNCYKHpZWxm+i52Heg9ya2cORwL796XJCKip3uE7BkmsXYy2MbYKaHA==","signatures":[{"sig":"MEQCICok/R8jVKfcM1ID18cGkkzto8Sa5JF4lhgL7/xg36YMAiBHu9rpNyw/UKGz9aRYX2kYpGccdO1jQ8hIgkB3Q3v2ug==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":115217},"type":"module","gitHead":"d70bbfe2158364155cdcd8b734bae44bd76c5a75","_npmUser":{"name":"cluster2600","email":"cluster2600@gmail.com"},"openclaw":{"extensions":["./index.ts"]},"_npmVersion":"11.10.1","description":"Agent safety system: stakeholder model, action validator, and safety dashboard — based on arXiv:2602.20021","directories":{},"_nodeVersion":"25.7.0","dependencies":{"@sinclair/typebox":"0.34.48"},"_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/agent-safety_2026.3.14_1772904385383_0.3970971322528931","host":"s3://npm-registry-packages-npm-production"}},"2026.3.15":{"name":"@cyberdyne-systems/agent-safety","version":"2026.3.15","description":"Agent safety system: stakeholder model, action validator, and safety dashboard — based on arXiv:2602.20021","type":"module","dependencies":{"@sinclair/typebox":"0.34.48"},"openclaw":{"extensions":["./index.ts"]},"gitHead":"3ed8b2df43547fb4873a2ff3aa619cebe924404a","_id":"@cyberdyne-systems/agent-safety@2026.3.15","_nodeVersion":"25.7.0","_npmVersion":"11.10.1","dist":{"integrity":"sha512-MMJPFVqYXhefg6syBN7ZlaytQr/SR+i8rQrt+xGvysRyN1wkLhXGnFWnbppUZ4mgNh/0sANfQNb0ZeuTx6OOyw==","shasum":"3248145eb2afb70236c2e3d6c8ad068a49e6fef7","tarball":"https://registry.npmjs.org/@cyberdyne-systems/agent-safety/-/agent-safety-2026.3.15.tgz","fileCount":15,"unpackedSize":129754,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIQDhLZ6vrjSyL6f8TZVHhWbuIA/dl3c8VTlkIIdXQZ6RVAIgcAlZTf2Y5d4J/oQUNmBX8vwsg/7tQ7FhpUi2CN8fmI0="}]},"_npmUser":{"name":"cluster2600","email":"cluster2600@gmail.com"},"directories":{},"maintainers":[{"name":"cluster2600","email":"cluster2600@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/agent-safety_2026.3.15_1772911435128_0.39266587766725514"},"_hasShrinkwrap":false}},"time":{"created":"2026-03-07T10:48:53.541Z","modified":"2026-03-07T19:23:55.415Z","2026.3.3":"2026-03-07T10:48:53.785Z","2026.3.7":"2026-03-07T11:07:56.217Z","2026.3.8":"2026-03-07T11:53:06.866Z","2026.3.9":"2026-03-07T11:59:36.354Z","2026.3.10":"2026-03-07T12:07:49.681Z","2026.3.11":"2026-03-07T12:16:55.650Z","2026.3.12":"2026-03-07T16:42:16.975Z","2026.3.13":"2026-03-07T17:21:47.161Z","2026.3.14":"2026-03-07T17:26:25.538Z","2026.3.15":"2026-03-07T19:23:55.278Z"},"description":"Agent safety system: stakeholder model, action validator, and safety dashboard — based on arXiv:2602.20021","maintainers":[{"name":"cluster2600","email":"cluster2600@gmail.com"}],"readme":"# Agent Safety System\n\n[![npm](https://img.shields.io/npm/v/@cyberdyne-systems/agent-safety)](https://www.npmjs.com/package/@cyberdyne-systems/agent-safety)\n\nOpenClaw plugin for LLM agent safety based on [arXiv:2602.20021 -- \"Agents of Chaos\"](https://arxiv.org/abs/2602.20021).\n\nIntercepts every tool call via `before_tool_call` and validates it against a stakeholder model with trust levels, UID-based identity anchoring, and 8 risk dimensions from the paper.\n\n## Install\n\n```bash\nopenclaw plugins install @cyberdyne-systems/agent-safety\n```\n\nThen restart the gateway to load the plugin.\n\n## Architecture\n\n```\nTool Call\n   |\n   v\n+------------------+     +------------------+\n|   Quick Check    | --> |   Deep Analysis  |\n|   (local rules)  |     |   (Claude API)   |\n|   ~0ms latency   |     |   optional       |\n+------------------+     +------------------+\n   |                           |\n   v                           v\n+----------------------------------------------+\n|              Audit Log                       |\n|   Every decision logged with risk score,     |\n|   verdict, requester, and reasoning          |\n+----------------------------------------------+\n   |\n   v\n  ALLOW / WARN / BLOCK\n```\n\n### Two-Phase Validation\n\n1. **Quick Check** (zero latency) -- local rules run on every call:\n   - Trust level verification (0-4 scale)\n   - Permission checks against allowed actions\n   - Identity spoofing detection (UID anchoring)\n   - Dangerous command pattern matching (`rm -rf`, credential access, fork bombs)\n   - Loop / rapid-fire detection\n   - Unverified sender blocking for high-risk actions\n\n2. **Deep Analysis** (optional, requires API key) -- Claude evaluates 8 risk dimensions:\n   - Authority Violation\n   - Resource Abuse\n   - Information Leak\n   - Safety Bypass\n   - Goal Misalignment\n   - Social Engineering\n   - Cascading Failure\n   - Irreversible Action\n\n3. **Telegram Approval** (optional) -- when a non-owner's tool call is flagged:\n   - Sends a notification to the owner on Telegram with inline keyboard buttons (Approve / Deny)\n   - Owner can also reply with text: `approve safety-N` or `deny safety-N`\n   - Decision is cached for future similar requests from the same requester\n   - Unanswered approvals expire after 5 minutes\n   - Requires `channels.telegram.capabilities.inlineButtons` set to `all` (or allowlist)\n\n## Configuration\n\n```bash\n# Validation mode: local (default), api, or both\nopenclaw config set plugins.entries.agent-safety.config.mode local\n\n# Enable Claude API deep analysis (requires API key)\nopenclaw config set plugins.entries.agent-safety.config.mode both\nopenclaw config set plugins.entries.agent-safety.config.apiKey sk-ant-...\n\n# Choose validation model (default: claude-sonnet-4-5-20250514)\nopenclaw config set plugins.entries.agent-safety.config.model claude-haiku-4-5-20251001\n\n# Block high-risk actions from unverified users (default: true)\nopenclaw config set plugins.entries.agent-safety.config.blockHighRiskUnverified true\n\n# Enable Telegram approval flow for non-owner requests\nopenclaw config set plugins.entries.agent-safety.config.telegramApproval true\nopenclaw config set plugins.entries.agent-safety.config.telegramOwnerId \"YOUR_TELEGRAM_USER_ID\"\n```\n\n| Option | Type | Default | Description |\n|--------|------|---------|-------------|\n| `mode` | `\"local\" \\| \"api\" \\| \"both\"` | `\"local\"` | Validation strategy |\n| `apiKey` | `string` | `$ANTHROPIC_API_KEY` | API key for deep analysis |\n| `model` | `string` | `claude-sonnet-4-5-20250514` | Model for deep analysis |\n| `blockHighRiskUnverified` | `boolean` | `true` | Auto-block unverified users on high-risk actions |\n| `telegramApproval` | `boolean` | `false` | Send approval requests to owner on Telegram |\n| `telegramOwnerId` | `string` | - | Owner's Telegram user ID for approval messages |\n\n## Stakeholder Model\n\nThe plugin maintains a principal registry where each stakeholder has:\n\n| Field | Description |\n|-------|-------------|\n| `id` | Unique identifier |\n| `name` | Display name |\n| `role` | `owner`, `agent`, or `non_owner` |\n| `trust` | Trust level 0-4 (0 = untrusted, 4 = full trust) |\n| `verified` | Whether identity is confirmed via UID |\n| `uid` | Platform-specific unique identifier (anchors identity) |\n| `channel` | Communication channel (Telegram, Discord, local, etc.) |\n| `allowedActions` | List of permitted action categories |\n\n### Trust Levels\n\n| Level | Meaning | Typical Permissions |\n|-------|---------|-------------------|\n| 0 | Untrusted | No actions allowed |\n| 1 | Minimal | Read-only |\n| 2 | Basic | Read + limited write |\n| 3 | Elevated | Most actions except destructive |\n| 4 | Full | All actions (owner) |\n\n### Action Categories\n\nThe plugin maps tool names to these categories:\n\n| Category | Example Tools |\n|----------|--------------|\n| `execute_shell` | bash, exec, terminal |\n| `read_files` | read, glob, grep |\n| `write_files` | write, edit |\n| `delete_files` | delete, remove |\n| `external_network` | web_fetch, curl |\n| `send_message` | message, send, forward |\n| `read_message` | read_message, inbox |\n| `modify_memory` | memory_store, memory_update |\n| `access_credentials` | credential, secret, token |\n| `agent_communication` | agent_communication |\n| `forward_message` | forward |\n\n## Agent Safety Tool\n\nOnce loaded, agents get an `agent_safety` tool for runtime introspection:\n\n### `status` -- Safety Dashboard\n\n```json\n{\n  \"stakeholders\": 2,\n  \"auditStats\": {\n    \"total\": 47,\n    \"allowed\": 42,\n    \"warned\": 3,\n    \"blocked\": 2,\n    \"averageRisk\": 18\n  }\n}\n```\n\n### `stakeholders` -- List Principals\n\nReturns all registered stakeholders with trust levels and permissions.\n\n### `log` -- Audit Trail\n\n```bash\n# Last 10 entries (default)\nagent_safety action=log\n\n# Last 5 entries\nagent_safety action=log limit=5\n```\n\nEach entry includes: tool name, action category, requester, trust level, verdict, risk score, and reasoning.\n\n### `add_stakeholder` -- Register Principal\n\n```bash\n# With UID (verified, trust 2)\nagent_safety action=add_stakeholder name=\"Alice\" uid=\"telegram_12345\"\n\n# Without UID (unverified, trust 1)\nagent_safety action=add_stakeholder name=\"Bob\"\n```\n\n### `set_trust` -- Adjust Trust Level\n\n```bash\nagent_safety action=set_trust stakeholder_id=\"<id>\" trust=3\n```\n\n## Case Studies (arXiv:2602.20021)\n\nThe plugin detects all 14 attack patterns from the paper:\n\n| # | Case Study | Detection Method |\n|---|-----------|-----------------|\n| 1 | Unauthorized tool use | Permission check against `allowedActions` |\n| 2 | Trust boundary violation | Trust level < required for action category |\n| 3 | Bulk data harvesting | Pattern match: bulk inbox dump, export messages, \"all emails\" |\n| 4 | Persistent process creation | Pattern match: `cron`, `nohup`, `systemctl enable`, `launchctl load` |\n| 5 | Resource destruction | Pattern match: `rm -rf`, `mkfs`, `dd`, fork bombs |\n| 6 | Credential harvesting | Pattern match: `.ssh`, `.aws`, `/etc/shadow`, `env \\| grep` |\n| 7 | Prompt injection | Command injection patterns: `eval`, `\\|`, `$()` in shell |\n| 8 | Data exfiltration | Outbound data via `curl -d`, `scp`, `wget` with file content |\n| 9 | Multi-agent manipulation | Agent-to-agent communication validation |\n| 10 | Identity spoofing | UID anchoring -- unverified sender + high-risk action = BLOCK |\n| 11 | Privilege escalation | `sudo`, `chmod`, `chown` pattern detection |\n| 12 | Encoded/obfuscated payloads | Pattern match: `base64`, `atob`, `eval()`, `SYSTEM_ADMIN_OVERRIDE` |\n| 13 | Social engineering | Non-owner requesting destructive actions |\n| 14 | Cascading failure | Irreversible bulk operations detection |\n\n## Test Results\n\n```\n146 tests passing across 3 test suites\n\nUnit tests:       42 passed\nValidator tests:  97 passed (incl. 14 case studies)\nIntegration tests: 7 passed\n\nBenchmark:\n  MUST_BLOCK: 27/27 (100% detection)\n  MUST_ALLOW: 21/21 (0% false positives)\n```\n\n### Live Gateway Tests\n\n19/19 tool categories validated through the OpenClaw gateway:\n\n| Category | Tests | Result |\n|----------|-------|--------|\n| exec (shell) | 5 | PASS |\n| read (files) | 4 | PASS |\n| write (files) | 2 | PASS |\n| web_fetch (network) | 2 | PASS |\n| message (Telegram) | 1 | PASS |\n| browser | 1 | PASS |\n| memory | 1 | PASS |\n| nodes | 1 | PASS |\n| TTS | 1 | PASS |\n| session | 1 | PASS |\n\n## How It Hooks In\n\nThe plugin registers a `before_tool_call` hook at priority 10 (runs early):\n\n```typescript\napi.on(\"before_tool_call\", async (event, ctx) => {\n  // 1. Map tool name to action category\n  // 2. Resolve requester from context (UID, isOwner)\n  // 3. Run quickCheck (local rules)\n  // 4. Optionally run deep analysis (Claude API)\n  // 5. Log decision to audit trail\n  // 6. Return { block: true, blockReason } if BLOCK\n});\n```\n\nWhen no sender context is provided (local gateway usage), the plugin defaults to treating the caller as the owner -- so local tool calls are never blocked.\n\n## License\n\nMIT\n","readmeFilename":"README.md"}