@gendigital/sage-openclaw 0.4.4 → 0.5.3

package/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "sage-openclaw",
   "name": "Sage",
-  "version": "0.4.4",
+  "version": "0.5.3",
   "description": "Safety for Agents — ADR layer that guards commands, files, and web requests",
   "skills": [
     "resources/skills/security-awareness"

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@gendigital/sage-openclaw",
   "license": "Apache-2.0",
-  "version": "0.4.4",
+  "version": "0.5.3",
   "type": "module",
   "description": "Safety for Agents — ADR layer for OpenClaw",
   "main": "./dist/index.cjs",
@@ -19,8 +19,13 @@
     "sync:assets": "node scripts/sync-assets.mjs",
     "test": "vitest run"
   },
+  "optionalDependencies": {
+    "koffi": "^2.9.0"
+  },
+  "dependencies": {
+    "@sage/core": "workspace:*"
+  },
   "devDependencies": {
-    "@sage/core": "workspace:*",
     "@types/node": "^22.0.0",
     "esbuild": "^0.25.0",
     "typescript": "^5.9.0",
@@ -34,6 +39,17 @@
   "engines": {
     "node": ">=18"
   },
+  "keywords": [
+    "openclaw",
+    "openclaw-plugin",
+    "security",
+    "adr",
+    "agent-security",
+    "safety",
+    "malware-detection",
+    "skill",
+    "ai-safety"
+  ],
   "publishConfig": {
     "access": "public"
   }

package/resources/threats/commands.yaml

@@ -66,7 +66,7 @@
   severity: critical
   confidence: 0.95
   action: block
-  pattern: "\\brm\\s+(-[a-zA-Z]*f[a-zA-Z]*\\s+)?(-[a-zA-Z]*r[a-zA-Z]*\\s+)?/\\s*$|\\brm\\s+(-[a-zA-Z]*r[a-zA-Z]*\\s+)?(-[a-zA-Z]*f[a-zA-Z]*\\s+)?/\\s*$|\\brm\\s+-[a-zA-Z]*rf[a-zA-Z]*\\s+/"
+  pattern: "\\brm\\s+(-[a-zA-Z]*f[a-zA-Z]*\\s+)?(-[a-zA-Z]*r[a-zA-Z]*\\s+)?/(\\s|$|[;&|*])|\\brm\\s+(-[a-zA-Z]*r[a-zA-Z]*\\s+)?(-[a-zA-Z]*f[a-zA-Z]*\\s+)?/(\\s|$|[;&|*])|\\brm\\s+-[a-zA-Z]*rf[a-zA-Z]*\\s+/(\\s|$|[;&|*])"
   match_on: command
   title: "Recursive forced deletion from root"
   expires_at: null
@@ -255,3 +255,53 @@
   title: "Loop executing shell or download commands"
   expires_at: null
   revoked: false
+
+# --- Cross-platform reverse shells (scripting languages) ---
+
+# Python socket reverse shell
+- id: "CLT-CMD-023"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "python[23]?\\s+-c.*socket.*connect.*(\\/bin\\/zsh|\\/bin\\/sh|\\/bin\\/bash)"
+  match_on: command
+  title: "Python reverse shell via socket"
+  expires_at: null
+  revoked: false
+
+# Ruby TCPSocket reverse shell
+- id: "CLT-CMD-024"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "ruby\\s+-e.*TCPSocket.*exec.*(\\/bin\\/zsh|\\/bin\\/sh)"
+  match_on: command
+  title: "Ruby reverse shell via TCPSocket"
+  expires_at: null
+  revoked: false
+
+# zsh -c reverse shell pattern
+- id: "CLT-CMD-025"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "\\bzsh\\s+-c\\b.*\\b(exec|socket|/dev/tcp)\\b"
+  match_on: command
+  title: "Zsh reverse shell pattern"
+  expires_at: null
+  revoked: false
+
+# --- Recursive deletion of critical system directories ---
+- id: "CLT-CMD-026"
+  category: tool
+  severity: critical
+  confidence: 0.95
+  action: block
+  pattern: "\\brm\\s+(-[a-zA-Z]+\\s+)*-[a-zA-Z]*[rR][a-zA-Z]*(\\s+-[a-zA-Z]+)*\\s+/(home|Users|etc|usr|var|boot|bin|sbin|lib|lib64|opt|root|System|Applications|Library|Volumes|private|mnt)\\b/?(\\s|$|[;&|])"
+  match_on: command
+  title: "Recursive deletion of critical system directory"
+  expires_at: null
+  revoked: false

package/resources/threats/credentials.yaml

@@ -32,7 +32,7 @@
   severity: high
   confidence: 0.80
   action: require_approval
-  pattern: "(>>|>)\\s*\\.env(\\.local|\\.production|\\.staging|\\.development)?\\b"
+  pattern: "(>>|>)\\s*\\.env(?!\\S*\\.(example|sample|template|dist)\\b)(\\.local|\\.production|\\.prod|\\.staging|\\.stage|\\.development|\\.dev|\\.test)?\\b"
   match_on: command
   title: "Write/append to .env file (potential credential exposure)"
   expires_at: null
@@ -44,7 +44,7 @@
   severity: high
   confidence: 0.80
   action: require_approval
-  pattern: "\\b(cat|less|more|head|tail)\\s+.*(\\.(env|env\\.local|env\\.production)|credentials|\\.aws/credentials|\\.ssh/id_rsa|\\.ssh/id_ed25519|\\.netrc|\\.pgpass)"
+  pattern: "\\b(cat|less|more|head|tail)\\s+.*(\\.(env(?!\\S*\\.(example|sample|template|dist)\\b)(\\.(local|production|prod|staging|stage|development|dev|test))?)|credentials|\\.aws/credentials|\\.ssh/id_rsa|\\.ssh/id_ed25519|\\.netrc|\\.pgpass)"
   match_on: command
   title: "Reading credential or secret file"
   expires_at: null

package/resources/threats/files.yaml

@@ -1,7 +1,7 @@
 # Sensitive file path threat patterns for Sage
 # Author: Gen Digital Inc.
 # License: DRL-1.1 (see threats/LICENSE)
-# Detects Write/Edit operations targeting security-sensitive files
+# Detects Read/Write/Edit/Delete operations targeting security-sensitive files
 
 # --- System auth files ---
 - id: "CLT-FILE-001"
@@ -11,7 +11,7 @@
   action: block
   pattern: "(/etc/passwd|/etc/shadow|/etc/sudoers)"
   match_on: file_path
-  title: "Write to system authentication file"
+  title: "Access system authentication file"
   expires_at: null
   revoked: false
 
@@ -23,7 +23,7 @@
   action: block
   pattern: "\\.ssh/authorized_keys"
   match_on: file_path
-  title: "Write to SSH authorized_keys (unauthorized access persistence)"
+  title: "Access SSH authorized_keys (unauthorized access persistence)"
   expires_at: null
   revoked: false
 
@@ -35,7 +35,7 @@
   action: require_approval
   pattern: "\\.ssh/(id_rsa|id_ed25519|id_ecdsa|id_dsa|config)$"
   match_on: file_path
-  title: "Write to SSH key or config file"
+  title: "Access SSH key or config file"
   expires_at: null
   revoked: false
 
@@ -47,19 +47,7 @@
   action: require_approval
   pattern: "\\.(bashrc|zshrc|profile|bash_profile|zprofile|zshenv)$"
   match_on: file_path
-  title: "Write to shell RC file (persistence mechanism)"
-  expires_at: null
-  revoked: false
-
-# --- macOS LaunchAgents/LaunchDaemons ---
-- id: "CLT-FILE-005"
-  category: tool
-  severity: high
-  confidence: 0.90
-  action: block
-  pattern: "(LaunchAgents|LaunchDaemons)/.*\\.plist$"
-  match_on: file_path
-  title: "Write to macOS LaunchAgent/LaunchDaemon plist"
+  title: "Access shell RC file (persistence mechanism)"
   expires_at: null
   revoked: false
 
@@ -71,7 +59,7 @@
   action: require_approval
   pattern: "(/etc/cron\\.(d|daily|hourly|weekly|monthly)/|/var/spool/cron/)"
   match_on: file_path
-  title: "Write to cron directory"
+  title: "Access cron directory"
   expires_at: null
   revoked: false
 
@@ -83,19 +71,23 @@
   action: require_approval
   pattern: "/etc/systemd/system/"
   match_on: file_path
-  title: "Write to systemd service unit file"
+  title: "Access systemd service unit file"
   expires_at: null
   revoked: false
 
 # --- Credential/env files ---
+# NOTE: Uses allowlist approach (explicit suffix enumeration) unlike CLT-CRED-003's
+# denylist approach (negative lookahead). This means unknown suffixes like .env.ci
+# match CRED-003 but not FILE-008 — intentional, since file_path matching is more
+# targeted than command-string matching.
 - id: "CLT-FILE-008"
   category: secrets
   severity: high
   confidence: 0.85
   action: require_approval
-  pattern: "(\\.env(\\.local|\\.production|\\.staging|\\.development)?|\\.aws/credentials|\\.netrc|\\.pgpass)$"
+  pattern: "((^|[\\/\\\\])\\.env(\\.local|\\.production|\\.prod|\\.staging|\\.stage|\\.development|\\.dev|\\.test)?|\\.aws/credentials|\\.netrc|\\.pgpass)$"
   match_on: file_path
-  title: "Write to credential or environment file"
+  title: "Access credential or environment file"
   expires_at: null
   revoked: false
 
@@ -107,6 +99,6 @@
   action: require_approval
   pattern: "\\.git/hooks/"
   match_on: file_path
-  title: "Write to git hook (potential code execution on git events)"
+  title: "Access git hook (potential code execution on git events)"
   expires_at: null
   revoked: false

package/resources/threats/mac-commands.yaml

@@ -0,0 +1,355 @@
+# macOS command threat patterns for Sage
+# Author: Gen Digital Inc.
+# License: DRL-1.1 (see threats/LICENSE)
+# Covers: osascript RCE, macOS LOLBins, destructive ops, defense evasion, privesc, reverse shells
+
+# --- osascript Remote Code Execution ---
+
+# osascript -e 'do shell script' (AppleScript shell execution)
+- id: "CLT-MAC-CMD-001"
+  category: tool
+  severity: critical
+  confidence: 0.95
+  action: block
+  pattern: "\\bosascript\\b.*-e.*do shell script"
+  case_insensitive: true
+  match_on: command
+  title: "AppleScript shell execution via osascript -e"
+  expires_at: null
+  revoked: false
+
+# osascript -l JavaScript (JXA execution)
+- id: "CLT-MAC-CMD-002"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "\\bosascript\\b.*-l\\s+JavaScript"
+  case_insensitive: true
+  match_on: command
+  title: "JavaScript for Automation (JXA) execution via osascript"
+  expires_at: null
+  revoked: false
+
+# Pipe to osascript (stdin AppleScript execution)
+- id: "CLT-MAC-CMD-003"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "\\|\\s*osascript"
+  match_on: command
+  title: "Piped input to osascript (stdin AppleScript execution)"
+  expires_at: null
+  revoked: false
+
+# osascript loading script file from remote download
+- id: "CLT-MAC-CMD-004"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "(curl|wget).*\\|.*osascript|osascript.*(curl|wget)"
+  case_insensitive: true
+  match_on: command
+  title: "Remote script download piped to osascript"
+  expires_at: null
+  revoked: false
+
+# --- open command abuse ---
+
+# open -a Terminal (launch Terminal with script)
+- id: "CLT-MAC-CMD-005"
+  category: tool
+  severity: high
+  confidence: 0.80
+  action: require_approval
+  pattern: "\\bopen\\s+-a\\s+Terminal"
+  match_on: command
+  title: "Launch Terminal application via open -a"
+  expires_at: null
+  revoked: false
+
+# open with hidden/background flags
+- id: "CLT-MAC-CMD-006"
+  category: tool
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\bopen\\s+(-[jg]|--hide|--background)"
+  match_on: command
+  title: "Launch application hidden/background via open"
+  expires_at: null
+  revoked: false
+
+# --- macOS LOLBins ---
+
+# dscl user/group manipulation
+- id: "CLT-MAC-CMD-007"
+  category: tool
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\bdscl\\b.*(-create|-delete|-passwd|-append)"
+  match_on: command
+  title: "Directory Services user/group manipulation via dscl"
+  expires_at: null
+  revoked: false
+
+# networksetup proxy/DNS manipulation
+- id: "CLT-MAC-CMD-008"
+  category: tool
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\bnetworksetup\\b.*(-setwebproxy|-setsocksfirewallproxy|-setdnsservers|-setautoproxyurl)"
+  case_insensitive: true
+  match_on: command
+  title: "Network proxy/DNS manipulation via networksetup"
+  expires_at: null
+  revoked: false
+
+# systemsetup enabling remote access
+- id: "CLT-MAC-CMD-009"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "\\bsystemsetup\\b.*(-setremotelogin\\s+on|-setwakeonnetworkaccess\\s+on)"
+  case_insensitive: true
+  match_on: command
+  title: "Enable remote login/wake via systemsetup"
+  expires_at: null
+  revoked: false
+
+# kickstart ARD remote management
+- id: "CLT-MAC-CMD-010"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "kickstart.*-activate.*-configure"
+  case_insensitive: true
+  match_on: command
+  title: "Apple Remote Desktop activation via kickstart"
+  expires_at: null
+  revoked: false
+
+# installer -pkg -target / (silent package install)
+- id: "CLT-MAC-CMD-011"
+  category: tool
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\binstaller\\b.*-pkg.*-target"
+  case_insensitive: true
+  match_on: command
+  title: "Silent package install via installer command"
+  expires_at: null
+  revoked: false
+
+# hdiutil mount remote DMG
+- id: "CLT-MAC-CMD-012"
+  category: tool
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\bhdiutil\\b.*\\b(attach|mount)\\b.*https?://"
+  case_insensitive: true
+  match_on: command
+  title: "Mount remote DMG via hdiutil"
+  expires_at: null
+  revoked: false
+
+# pkgutil --forget (package receipt manipulation)
+- id: "CLT-MAC-CMD-013"
+  category: tool
+  severity: high
+  confidence: 0.80
+  action: require_approval
+  pattern: "\\bpkgutil\\b.*--forget"
+  match_on: command
+  title: "Package receipt removal via pkgutil --forget"
+  expires_at: null
+  revoked: false
+
+# --- Destructive Operations ---
+
+# diskutil eraseDisk
+- id: "CLT-MAC-CMD-014"
+  category: tool
+  severity: critical
+  confidence: 0.95
+  action: block
+  pattern: "\\bdiskutil\\b.*\\b(eraseDisk|partitionDisk|secureErase)\\b"
+  match_on: command
+  title: "Disk erase/partition via diskutil"
+  expires_at: null
+  revoked: false
+
+# tmutil delete (Time Machine backup deletion — ransomware indicator)
+- id: "CLT-MAC-CMD-015"
+  category: tool
+  severity: critical
+  confidence: 0.95
+  action: block
+  pattern: "\\btmutil\\b.*\\b(delete|disable)\\b"
+  match_on: command
+  title: "Time Machine backup deletion/disable via tmutil (ransomware indicator)"
+  expires_at: null
+  revoked: false
+
+# --- Defense Evasion ---
+
+# spctl --master-disable (Gatekeeper disable)
+- id: "CLT-MAC-CMD-016"
+  category: tool
+  severity: critical
+  confidence: 0.95
+  action: block
+  pattern: "\\bspctl\\b.*--master-disable"
+  match_on: command
+  title: "Gatekeeper disable via spctl --master-disable"
+  expires_at: null
+  revoked: false
+
+# csrutil disable (SIP disable)
+- id: "CLT-MAC-CMD-017"
+  category: tool
+  severity: critical
+  confidence: 0.95
+  action: block
+  pattern: "\\bcsrutil\\b.*\\bdisable\\b"
+  match_on: command
+  title: "System Integrity Protection disable via csrutil"
+  expires_at: null
+  revoked: false
+
+# defaults write LSQuarantine (quarantine flag disable)
+- id: "CLT-MAC-CMD-018"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "\\bdefaults\\b.*\\bwrite\\b.*LSQuarantine"
+  case_insensitive: true
+  match_on: command
+  title: "Quarantine flag disable via defaults write LSQuarantine"
+  expires_at: null
+  revoked: false
+
+# xattr -d com.apple.quarantine (quarantine removal)
+- id: "CLT-MAC-CMD-019"
+  category: tool
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\bxattr\\b.*-d.*com\\.apple\\.quarantine"
+  match_on: command
+  title: "Quarantine attribute removal via xattr"
+  expires_at: null
+  revoked: false
+
+# pfctl -d (packet filter / firewall disable)
+- id: "CLT-MAC-CMD-020"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "\\bpfctl\\b.*\\s-d\\b"
+  match_on: command
+  title: "Packet filter (firewall) disable via pfctl -d"
+  expires_at: null
+  revoked: false
+
+# tccutil reset (TCC privacy permissions reset)
+- id: "CLT-MAC-CMD-021"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "\\btccutil\\b.*\\breset\\b"
+  match_on: command
+  title: "TCC privacy permissions reset via tccutil"
+  expires_at: null
+  revoked: false
+
+# launchctl unload security daemons
+- id: "CLT-MAC-CMD-022"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "\\blaunchctl\\b.*\\b(unload|bootout)\\b.*(com\\.apple\\.MRT|com\\.apple\\.XProtect|com\\.apple\\.security)"
+  case_insensitive: true
+  match_on: command
+  title: "Unload macOS security daemon via launchctl"
+  expires_at: null
+  revoked: false
+
+# defaults write to disable macOS security features
+- id: "CLT-MAC-CMD-023"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "\\bdefaults\\b.*\\bwrite\\b.*(com\\.apple\\.Finder\\s+AppleShowAllFiles|com\\.apple\\.LaunchServices\\s+LSQuarantine|com\\.apple\\.loginwindow)"
+  case_insensitive: true
+  match_on: command
+  title: "Modify macOS security-related defaults"
+  expires_at: null
+  revoked: false
+
+# --- Privilege Escalation ---
+
+# dscl . -passwd (change user password)
+- id: "CLT-MAC-CMD-024"
+  category: tool
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "\\bdscl\\b.*\\s-passwd\\b"
+  match_on: command
+  title: "User password change via dscl"
+  expires_at: null
+  revoked: false
+
+# dseditgroup add user to admin
+- id: "CLT-MAC-CMD-025"
+  category: tool
+  severity: critical
+  confidence: 0.95
+  action: block
+  pattern: "\\bdseditgroup\\b.*-o\\s+edit.*-a.*admin"
+  match_on: command
+  title: "Add user to admin group via dseditgroup"
+  expires_at: null
+  revoked: false
+
+# createhomedir — create home directory for arbitrary user
+- id: "CLT-MAC-CMD-026"
+  category: tool
+  severity: high
+  confidence: 0.80
+  action: require_approval
+  pattern: "\\bcreatehomedir\\b"
+  match_on: command
+  title: "Create home directory for user via createhomedir"
+  expires_at: null
+  revoked: false
+
+# Reverse shells (Python, Ruby, zsh) moved to commands.yaml (CLT-CMD-023..025)
+
+# --- Clipboard / Screen Capture ---
+
+# screencapture to remote or hidden location
+- id: "CLT-MAC-CMD-027"
+  category: tool
+  severity: high
+  confidence: 0.80
+  action: require_approval
+  pattern: "\\bscreencapture\\b.*(-x|-C)"
+  match_on: command
+  title: "Silent screen capture via screencapture"
+  expires_at: null
+  revoked: false

package/resources/threats/mac-credentials.yaml

@@ -0,0 +1,99 @@
+# macOS credential exposure threat patterns for Sage
+# Author: Gen Digital Inc.
+# License: DRL-1.1 (see threats/LICENSE)
+
+# Keychain password extraction (find-generic-password)
+- id: "CLT-MAC-CRED-001"
+  category: secrets
+  severity: critical
+  confidence: 0.95
+  action: block
+  pattern: "\\bsecurity\\b.*\\bfind-generic-password\\b.*-w"
+  match_on: command
+  title: "Keychain password extraction via security find-generic-password"
+  expires_at: null
+  revoked: false
+
+# Keychain internet password extraction
+- id: "CLT-MAC-CRED-002"
+  category: secrets
+  severity: critical
+  confidence: 0.95
+  action: block
+  pattern: "\\bsecurity\\b.*\\bfind-internet-password\\b.*-w"
+  match_on: command
+  title: "Keychain internet password extraction via security find-internet-password"
+  expires_at: null
+  revoked: false
+
+# Keychain dump
+- id: "CLT-MAC-CRED-003"
+  category: secrets
+  severity: critical
+  confidence: 0.95
+  action: block
+  pattern: "\\bsecurity\\b.*\\bdump-keychain\\b"
+  match_on: command
+  title: "Full keychain dump via security dump-keychain"
+  expires_at: null
+  revoked: false
+
+# Keychain unlock with plaintext password
+- id: "CLT-MAC-CRED-004"
+  category: secrets
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "\\bsecurity\\b.*\\bunlock-keychain\\b.*-p"
+  match_on: command
+  title: "Keychain unlock with plaintext password"
+  expires_at: null
+  revoked: false
+
+# Keychain export
+- id: "CLT-MAC-CRED-005"
+  category: secrets
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\bsecurity\\b.*\\bexport\\b.*-k"
+  match_on: command
+  title: "Keychain item export via security export"
+  expires_at: null
+  revoked: false
+
+# Keychain deletion
+- id: "CLT-MAC-CRED-006"
+  category: secrets
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "\\bsecurity\\b.*\\bdelete-keychain\\b"
+  match_on: command
+  title: "Keychain deletion via security delete-keychain"
+  expires_at: null
+  revoked: false
+
+# Directory Services auth data read
+- id: "CLT-MAC-CRED-007"
+  category: secrets
+  severity: high
+  confidence: 0.85
+  action: require_approval
+  pattern: "\\bdscl\\b.*-read.*(AuthenticationAuthority|Password|ShadowHash)"
+  match_on: command
+  title: "Read user authentication data via dscl"
+  expires_at: null
+  revoked: false
+
+# Direct Keychain SQLite access
+- id: "CLT-MAC-CRED-008"
+  category: secrets
+  severity: critical
+  confidence: 0.90
+  action: block
+  pattern: "\\bsqlite3\\b.*(/Library/Keychains/|login\\.keychain)"
+  match_on: command
+  title: "Direct Keychain database access via sqlite3"
+  expires_at: null
+  revoked: false