agent-aegis

What it is

AgentAegis is a built-in runtime security plugin for OpenClaw-style LLM agents from Ant Group. The summary already states the five-layer architecture and threat coverage; what the page adds is the concrete install/configuration surface and the specific defense knobs, which is what an engineer needs to actually roll it out.

How it works

The five layers hook into nine OpenClaw lifecycle hooks, spanning intent scanning, tool-call governance, tool-result inspection, asset protection, and output safeguarding. Notable specifics the summary omits:

• Memory Contamination Guard rejects suspicious or oversized writes specifically to memory_store, MEMORY.md, SOUL.md, and memory/.
• Tool Result Inspection treats external tool outputs as untrusted, scanning for injection/escalation before they reach the next reasoning step.
• Decision Alignment Layer forces secondary user confirmation on ambiguous instructions.
• Output Redaction masks API keys/tokens before assistant output is sent or stored.

What to do

Install and enable in observe mode first, then promote individual defenses to enforce. The page gives these verbatim:

git clone https://github.com/antgroup/agent-aegis
openclaw plugins install ./agent-aegis

Safe-rollout config (monitor only):

{
  "allDefensesEnabled": true,
  "defaultBlockingMode": "observe"
}

Promote high-confidence defenses to blocking:

{
  "allDefensesEnabled": true,
  "defaultBlockingMode": "observe",
  "selfProtectionMode": "enforce",
  "commandBlockMode": "enforce",
  "memoryGuardMode": "enforce",
  "exfiltrationGuardMode": "enforce"
}

Each control supports enforce, observe, and off. Define protectedPaths, protectedSkills, and protectedPlugins for the assets in your environment, and use startupSkillScan to flag risky skills at startup. Detections surface as runtime observations, blocked actions, and promoted prompt warnings.

flowchart LR
  A[allDefensesEnabled + defaultBlockingMode: observe] --> B{Detections<br/>trustworthy?}
  B -->|yes| C[Set individual modes: enforce]
  B -->|no| D[Stay in observe / tune]
  C --> E[Blocked actions]
  A --> F[Runtime observations only]

Caveats

The distinction the page leans on is that AgentAegis is an active built-in plugin rather than passive prompt- or skill-based defense — but it is single-vendor (Ant Group) and self-described; no independent evaluation, benchmark, version number, or false-positive rate is given. observe-mode detections do not block, so the promotion step to enforce is where actual protection begins, and the page provides no guidance on which detections are reliable enough to promote.