@gendigital/sage-openclaw 0.8.0 → 0.9.0

package/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "sage-openclaw",
   "name": "Sage",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Safety for Agents — ADR layer that guards commands, files, and web requests",
   "skills": [
     "resources/skills/security-awareness"

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@gendigital/sage-openclaw",
   "license": "Apache-2.0",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "type": "module",
   "description": "Safety for Agents — ADR layer for OpenClaw",
   "main": "./dist/index.cjs",
@@ -21,7 +21,7 @@
     "esbuild": "^0.25.0",
     "typescript": "^5.9.0",
     "vitest": "^4.0.0",
-    "@gendigital/sage-core": "0.8.0"
+    "@gendigital/sage-core": "0.9.0"
   },
   "openclaw": {
     "extensions": [
@@ -29,6 +29,9 @@
     ],
     "compat": {
       "pluginApi": ">=2026.3.28"
+    },
+    "build": {
+      "openclawVersion": "2026.3.28"
     }
   },
   "engines": {

package/resources/threats/commands.yaml

@@ -164,15 +164,19 @@
   expires_at: null
   revoked: false
 
-# --- Python one-liner with dangerous imports ---
+# --- Python one-liner with dangerous calls ---
+# Matches actual call sites (`name(`) rather than bare imports — `import
+# subprocess` alone is harmless; `subprocess.run(...)` is what we care about.
+# Uses `[\s\S]` to span newlines (loader does not set the `s` flag) and a
+# bounded non-greedy quantifier to avoid catastrophic backtracking.
 - id: "CLT-CMD-015"
   category: tool
   severity: high
   confidence: 0.80
   action: require_approval
-  pattern: "python[3]?\\s+-c\\s+[\"'][^\"']*\\b(os\\.system|subprocess|os\\.exec|os\\.popen|__import__)\\b"
+  pattern: "python[3]?\\s+-c\\s+[\"'][\\s\\S]{0,2048}?(?:os\\.(?:system|popen|exec[lv]?[ep]?e?)|subprocess\\.(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|__import__)\\s*\\("
   match_on: command
-  title: "Python one-liner with dangerous imports"
+  title: "Python one-liner invoking shell/exec/subprocess call"
   expires_at: null
   revoked: false
 
@@ -204,7 +208,10 @@
   severity: high
   confidence: 0.85
   action: block
-  pattern: "\\bxargs\\b[^|;]*\\b(curl|wget|bash|sh)\\b"
+  # The lookarounds prevent matching short-option flags like `du -sh` or
+  # identifiers like `shell`/`bashrc`; only standalone command invocations
+  # (preceded by whitespace, `/`, etc.) are flagged.
+  pattern: "\\bxargs\\b[^|;]*(?<![-\\w])(curl|wget|bash|sh)(?![-\\w])"
   match_on: command
   title: "xargs dispatching download or shell execution"
   expires_at: null

package/resources/threats/dummy.yaml

@@ -0,0 +1,195 @@
+# Dummy threat patterns for Sage smoke-testing
+# Author: Test — NOT real threats
+#
+# Canary rules that match completely harmless, highly-specific marker strings.
+# The "__sage_test_" prefix would never appear in real-world code,
+# making false positives essentially impossible.
+#
+# Coverage matrix:
+#   Tool           match_on    block(deny)  require_approval(ask)  log(allow)
+#   ───────────    ────────    ───────────  ─────────────────────  ──────────
+#   Bash           command     ✓ ✓          ✓ ✓                    ✓
+#   Write/Edit     file_path   ✓            ✓                      ✓
+#   Write/Edit     content     ✓            ✓                      ✓
+#   WebFetch/Bash  url         ✓            ✓                      ✓
+#   WebFetch/Bash  domain      ✓            —                      —
+#
+# The file_path rules also cover Read, Delete, Glob, and LS tools
+# (they produce the same artifact type).
+# The url rules also cover URLs embedded in Bash commands and file content.
+
+# ─── Command patterns (Bash tool) ───────────────────────────────────
+
+- id: "DUMMY-CMD-DENY-001"
+  category: testing
+  severity: critical
+  confidence: 0.95
+  action: block
+  pattern: "__sage_test_deny_cmd_a75bf229__"
+  match_on: command
+  title: "[TEST] Canary deny command (alpha)"
+  expires_at: null
+  revoked: false
+
+- id: "DUMMY-CMD-DENY-002"
+  category: testing
+  severity: critical
+  confidence: 0.95
+  action: block
+  pattern: "__sage_test_deny_run_c3d91e4a__"
+  match_on: command
+  title: "[TEST] Canary deny command (bravo)"
+  expires_at: null
+  revoked: false
+
+- id: "DUMMY-CMD-ASK-001"
+  category: testing
+  severity: high
+  confidence: 0.90
+  action: require_approval
+  pattern: "__sage_test_ask_cmd_8f2e6b71__"
+  match_on: command
+  title: "[TEST] Canary approval command (alpha)"
+  expires_at: null
+  revoked: false
+
+- id: "DUMMY-CMD-ASK-002"
+  category: testing
+  severity: high
+  confidence: 0.90
+  action: require_approval
+  pattern: "__sage_test_ask_run_d4a09c53__"
+  match_on: command
+  title: "[TEST] Canary approval command (bravo)"
+  expires_at: null
+  revoked: false
+
+- id: "DUMMY-CMD-LOG-001"
+  category: testing
+  severity: low
+  confidence: 0.90
+  action: log
+  pattern: "__sage_test_log_cmd_1b7e3f82__"
+  match_on: command
+  title: "[TEST] Canary log-only command"
+  expires_at: null
+  revoked: false
+
+# ─── File-path patterns (Write / Edit / Read / Delete tools) ────────
+
+- id: "DUMMY-FILE-DENY-001"
+  category: testing
+  severity: critical
+  confidence: 0.95
+  action: block
+  pattern: "__sage_test_deny_file_e6c4a918__"
+  match_on: file_path
+  title: "[TEST] Canary deny file path"
+  expires_at: null
+  revoked: false
+
+- id: "DUMMY-FILE-ASK-001"
+  category: testing
+  severity: high
+  confidence: 0.90
+  action: require_approval
+  pattern: "__sage_test_ask_file_52fd7b36__"
+  match_on: file_path
+  title: "[TEST] Canary approval file path"
+  expires_at: null
+  revoked: false
+
+- id: "DUMMY-FILE-LOG-001"
+  category: testing
+  severity: low
+  confidence: 0.90
+  action: log
+  pattern: "__sage_test_log_file_9a13de74__"
+  match_on: file_path
+  title: "[TEST] Canary log-only file path"
+  expires_at: null
+  revoked: false
+
+# ─── Content patterns (Write / Edit tools — file body) ──────────────
+
+- id: "DUMMY-CONTENT-DENY-001"
+  category: testing
+  severity: critical
+  confidence: 0.95
+  action: block
+  pattern: "__SAGE_TEST_DENY_CONTENT_3c8f15b7__"
+  match_on: content
+  title: "[TEST] Canary deny content"
+  expires_at: null
+  revoked: false
+
+- id: "DUMMY-CONTENT-ASK-001"
+  category: testing
+  severity: high
+  confidence: 0.90
+  action: require_approval
+  pattern: "__SAGE_TEST_ASK_CONTENT_7d4ea2c9__"
+  match_on: content
+  title: "[TEST] Canary approval content"
+  expires_at: null
+  revoked: false
+
+- id: "DUMMY-CONTENT-LOG-001"
+  category: testing
+  severity: low
+  confidence: 0.90
+  action: log
+  pattern: "__SAGE_TEST_LOG_CONTENT_f0b683d1__"
+  match_on: content
+  title: "[TEST] Canary log-only content"
+  expires_at: null
+  revoked: false
+
+# ─── URL patterns (WebFetch / Bash / Write content) ─────────────────
+# Uses .test TLD (RFC 2606 reserved, never resolves) for safety.
+
+- id: "DUMMY-URL-DENY-001"
+  category: testing
+  severity: critical
+  confidence: 0.95
+  action: block
+  pattern: "sage-canary-deny-4e91ca37\\.test"
+  match_on: url
+  title: "[TEST] Canary deny URL"
+  expires_at: null
+  revoked: false
+
+- id: "DUMMY-URL-ASK-001"
+  category: testing
+  severity: high
+  confidence: 0.90
+  action: require_approval
+  pattern: "sage-canary-ask-b26d80f5\\.test"
+  match_on: url
+  title: "[TEST] Canary approval URL"
+  expires_at: null
+  revoked: false
+
+- id: "DUMMY-URL-LOG-001"
+  category: testing
+  severity: low
+  confidence: 0.90
+  action: log
+  pattern: "sage-canary-log-65f3d7a4\\.test"
+  match_on: url
+  title: "[TEST] Canary log-only URL"
+  expires_at: null
+  revoked: false
+
+# ─── Domain pattern (verifies domain→url routing in heuristics) ─────
+
+- id: "DUMMY-DOMAIN-DENY-001"
+  category: testing
+  severity: critical
+  confidence: 0.95
+  action: block
+  pattern: "sage-canary-domain-0c82eb16\\.test"
+  match_on: domain
+  title: "[TEST] Canary deny domain"
+  expires_at: null
+  revoked: false

package/resources/threats/mitre.yaml

@@ -165,7 +165,7 @@
   severity: high
   confidence: 0.80
   action: require_approval
-  pattern: "(telnet(\\.exe)?|nmap(\\.exe)?|Invoke-ARPScan\\.ps1|Invoke-PortScan\\.ps1|Invoke-SMBScanner\\.ps1|Port-Scan\\.ps1)"
+  pattern: "(\\btelnet(\\.exe)?\\b|\\bnmap(\\.exe)?\\b|Invoke-ARPScan\\.ps1|Invoke-PortScan\\.ps1|Invoke-SMBScanner\\.ps1|Port-Scan\\.ps1)"
   case_insensitive: true
   match_on: command
   title: "MITRE ATT&CK T1046 - Network Service Scanning"
@@ -191,7 +191,7 @@
   severity: high
   confidence: 0.80
   action: require_approval
-  pattern: "(schtasks(\\.exe)?\\s+/create|schtasks(\\.exe)?\\s+/%windir:~0,1%reate|at\\.exe)"
+  pattern: "(schtasks(\\.exe)?\\s+/create|schtasks(\\.exe)?\\s+/%windir:~0,1%reate|\\bat\\.exe\\b)"
   case_insensitive: true
   match_on: command
   title: "MITRE ATT&CK T1053.005 - Scheduled Task"

package/resources/threats/prompt-injection.yaml

@@ -0,0 +1,334 @@
+# Prompt injection detection heuristic rules (tier 1)
+# Catches common PI patterns with zero model dependency, ~1ms.
+# Designed for low false-positive rate on coding content.
+#
+# Sources: original Sage PI prototype, PR #90 (promptware), @stackone/defender patterns.
+# These complement the ML model (tier 2) which handles subtler attacks.
+
+# ── Instruction Override ────────────────────────────────────────────
+# The most common PI pattern family. Well-established attack surface.
+
+- id: "CLT-PI-001"
+  category: prompt_injection
+  severity: critical
+  confidence: 0.90
+  action: block
+  case_insensitive: true
+  pattern: "ignore\\s+(all\\s+)?(previous|prior|above|earlier)\\s+(instructions?|directives?|rules?|guidelines?|prompts?|directions?)"
+  match_on: content
+  title: "Instruction override: ignore previous"
+  expires_at: null
+  revoked: false
+
+- id: "CLT-PI-002"
+  category: prompt_injection
+  severity: critical
+  confidence: 0.90
+  action: block
+  case_insensitive: true
+  pattern: "disregard\\s+(all\\s+)?(previous|prior|above|your)\\s+(instructions?|directives?|rules?|guidelines?|safety)"
+  match_on: content
+  title: "Instruction override: disregard directives"
+  expires_at: null
+  revoked: false
+
+- id: "CLT-PI-003"
+  category: prompt_injection
+  severity: critical
+  confidence: 0.90
+  action: block
+  case_insensitive: true
+  pattern: "forget\\s+(all\\s+)?(your\\s+)?(previous\\s+)?(instructions?|rules?|guidelines?|restrictions?|constraints?|context)"
+  match_on: content
+  title: "Instruction override: forget instructions"
+  expires_at: null
+  revoked: false
+
+- id: "CLT-PI-004"
+  category: prompt_injection
+  severity: critical
+  confidence: 0.90
+  action: block
+  case_insensitive: true
+  pattern: "override\\s+(the\\s+)?(system\\s+)?(prompt|instructions?|rules?|guidelines?)"
+  match_on: content
+  title: "Instruction override: direct override"
+  expires_at: null
+  revoked: false
+
+- id: "CLT-PI-005"
+  category: prompt_injection
+  severity: high
+  confidence: 0.85
+  action: block
+  case_insensitive: true
+  pattern: "(new|updated?|revised?|changed?)\\s+instructions?:\\s*"
+  match_on: content
+  title: "Instruction override: inject new instructions"
+  expires_at: null
+  revoked: false
+
+# ── Role / Persona Override ─────────────────────────────────────────
+# Attempts to reassign the AI's identity or role.
+
+- id: "CLT-PI-010"
+  category: prompt_injection
+  severity: critical
+  confidence: 0.90
+  action: block
+  case_insensitive: true
+  pattern: "you\\s+are\\s+now\\s+(a\\s+)?(different|new|the|my|an?\\s+unrestricted|an?\\s+unfiltered)"
+  match_on: content
+  title: "Role override: identity reassignment"
+  expires_at: null
+  revoked: false
+
+- id: "CLT-PI-011"
+  category: prompt_injection
+  severity: high
+  confidence: 0.85
+  action: block
+  case_insensitive: true
+  pattern: "\\bDAN\\b.*?(do\\s+anything|jailbreak|no\\s+restrictions)"
+  match_on: content
+  title: "Role override: DAN jailbreak"
+  expires_at: null
+  revoked: false
+
+- id: "CLT-PI-012"
+  category: prompt_injection
+  severity: high
+  confidence: 0.85
+  action: block
+  case_insensitive: true
+  pattern: "developer\\s+mode\\s+(is\\s+)?(now\\s+)?(enabled?|activated?|on).{0,50}(comply|content\\s+polic|no\\s+restrict|without\\s+restrict|any\\s+request)"
+  match_on: content
+  title: "Role override: developer mode jailbreak"
+  expires_at: null
+  revoked: false
+
+- id: "CLT-PI-013"
+  category: prompt_injection
+  severity: high
+  confidence: 0.85
+  action: block
+  case_insensitive: true
+  pattern: "act\\s+(as|like)\\s+(a\\s+)?(system|admin|root|superuser)"
+  match_on: content
+  title: "Role override: privileged role assumption"
+  expires_at: null
+  revoked: false
+
+# ── Security Bypass ─────────────────────────────────────────────────
+# Attempts to disable safety mechanisms.
+
+- id: "CLT-PI-020"
+  category: prompt_injection
+  severity: critical
+  confidence: 0.85
+  action: block
+  case_insensitive: true
+  pattern: "(bypass|disable)\\s+(the\\s+)?(security|safety|guardrails?|filters?|restrictions?)"
+  match_on: content
+  title: "Security bypass: disable safety features"
+  expires_at: null
+  revoked: false
+
+- id: "CLT-PI-021"
+  category: prompt_injection
+  severity: high
+  confidence: 0.85
+  action: block
+  case_insensitive: true
+  pattern: "ignore\\s+(the\\s+)?(safety|security|ethical)\\s+(guidelines?|rules?|restrictions?)"
+  match_on: content
+  title: "Security bypass: ignore safety guidelines"
+  expires_at: null
+  revoked: false
+
+- id: "CLT-PI-022"
+  category: prompt_injection
+  severity: high
+  confidence: 0.80
+  action: block
+  case_insensitive: true
+  pattern: "skip\\s+(all\\s+)?security\\s+checks"
+  match_on: content
+  title: "Security bypass: skip security checks"
+  expires_at: null
+  revoked: false
+
+- id: "CLT-PI-023"
+  category: prompt_injection
+  severity: critical
+  confidence: 0.90
+  action: block
+  case_insensitive: true
+  pattern: "system\\s+override.{0,50}(execut|disabl|bypass|security|safet|comply|filter)"
+  match_on: content
+  title: "Security bypass: system override with action"
+  expires_at: null
+  revoked: false
+
+# ── Anti-Transparency ──────────────────────────────────────────────
+# Instructions to hide activity from the user.
+
+- id: "CLT-PI-030"
+  category: prompt_injection
+  severity: critical
+  confidence: 0.90
+  action: block
+  case_insensitive: true
+  pattern: "do\\s+not\\s+(tell|inform|mention|reveal|show|disclose)\\s+(the\\s+)?(user|human|operator|developer)"
+  match_on: content
+  title: "Anti-transparency: hide from user"
+  expires_at: null
+  revoked: false
+
+# ── Prompt Exfiltration ────────────────────────────────────────────
+# Attempts to extract the system prompt or instructions.
+
+- id: "CLT-PI-040"
+  category: prompt_injection
+  severity: high
+  confidence: 0.85
+  action: block
+  case_insensitive: true
+  pattern: "reveal\\s+(your\\s+)?(system\\s+)?prompt"
+  match_on: content
+  title: "Prompt exfiltration: reveal system prompt"
+  expires_at: null
+  revoked: false
+
+- id: "CLT-PI-041"
+  category: prompt_injection
+  severity: high
+  confidence: 0.85
+  action: block
+  case_insensitive: true
+  pattern: "show\\s+(me\\s+)?(your\\s+)?(initial|original|system|hidden)\\s+instructions?"
+  match_on: content
+  title: "Prompt exfiltration: show hidden instructions"
+  expires_at: null
+  revoked: false
+
+- id: "CLT-PI-042"
+  category: prompt_injection
+  severity: high
+  confidence: 0.85
+  action: block
+  case_insensitive: true
+  pattern: "repeat\\s+(back\\s+)?(everything|all|your\\s+instructions?)"
+  match_on: content
+  title: "Prompt exfiltration: repeat instructions"
+  expires_at: null
+  revoked: false
+
+- id: "CLT-PI-043"
+  category: prompt_injection
+  severity: high
+  confidence: 0.85
+  action: block
+  case_insensitive: true
+  pattern: "output\\s+(your\\s+)?(initialization|system\\s+prompt|initial\\s+instructions?)"
+  match_on: content
+  title: "Prompt exfiltration: output initialization"
+  expires_at: null
+  revoked: false
+
+# ── Structural Injection ───────────────────────────────────────────
+# Injection hiding in HTML, markdown, or JSON structures.
+
+- id: "CLT-PI-050"
+  category: prompt_injection
+  severity: high
+  confidence: 0.85
+  action: block
+  case_insensitive: true
+  pattern: "<!--\\s*(?:system|ignore|instruction|prompt|important|override|execute).*?-->"
+  match_on: content
+  title: "Structural injection: HTML comment with injection keywords"
+  expires_at: null
+  revoked: false
+
+- id: "CLT-PI-051"
+  category: prompt_injection
+  severity: high
+  confidence: 0.85
+  action: block
+  case_insensitive: true
+  pattern: "\\[.*?\\]\\(.*?(?:ignore|forget|system|instruction|override).*?\\)"
+  match_on: content
+  title: "Structural injection: markdown link with hidden injection"
+  expires_at: null
+  revoked: false
+
+# ── Role Marker Injection ──────────────────────────────────────────
+# Fake conversation turn markers to confuse the model.
+
+- id: "CLT-PI-060"
+  category: prompt_injection
+  severity: high
+  confidence: 0.85
+  action: block
+  case_insensitive: true
+  pattern: "\\n\\s*\\n\\s*(Human|User|Assistant|System)\\s*:"
+  match_on: content
+  title: "Role marker injection: fake conversation turn"
+  expires_at: null
+  revoked: false
+
+- id: "CLT-PI-061"
+  category: prompt_injection
+  severity: high
+  confidence: 0.85
+  action: block
+  case_insensitive: true
+  pattern: "\\[INST\\]|\\[/INST\\]"
+  match_on: content
+  title: "Role marker injection: Llama instruction format"
+  expires_at: null
+  revoked: false
+
+# ── Encoding / Obfuscation ─────────────────────────────────────────
+# Obfuscated injection attempts.
+
+- id: "CLT-PI-070"
+  category: prompt_injection
+  severity: high
+  confidence: 0.80
+  action: require_approval
+  case_insensitive: true
+  pattern: "1gn0r3|f0rg3t|byp4ss|syst3m|4dm1n"
+  match_on: content
+  title: "Encoding: leetspeak obfuscation of injection keywords"
+  expires_at: null
+  revoked: false
+
+# ── Credential Exfiltration via Injection ──────────────────────────
+# PI-driven data exfiltration patterns. Note: bare curl/wget commands
+# are NOT PI — these only match when combined with credential targets.
+
+- id: "CLT-PI-080"
+  category: prompt_injection
+  severity: high
+  confidence: 0.80
+  action: block
+  case_insensitive: true
+  pattern: "cat\\s+~/\\.(env|ssh|aws|gnupg).*\\|.*curl"
+  match_on: content
+  title: "Credential exfiltration: pipe dotfile to curl"
+  expires_at: null
+  revoked: false
+
+- id: "CLT-PI-081"
+  category: prompt_injection
+  severity: high
+  confidence: 0.80
+  action: block
+  case_insensitive: true
+  pattern: "output\\s+(all\\s+)?(the\\s+)?environment\\s+variables.{0,50}(send|post|upload|exfiltrat|curl|fetch)"
+  match_on: content
+  title: "Credential exfiltration: dump env vars and send"
+  expires_at: null
+  revoked: false

package/resources/threats/urls.yaml

@@ -39,14 +39,17 @@
   revoked: false
 
 # --- IP-based URLs (often C2 or staging) ---
+# Excludes loopback (127/8), unspecified (0/8), RFC1918 private
+# (10/8, 172.16/12, 192.168/16), and link-local (169.254/16) ranges,
+# which are common in local development and rarely indicate C2 traffic.
 - id: "CLT-URL-004"
   category: network_egress
   severity: medium
   confidence: 0.65
   action: require_approval
-  pattern: "https?://\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}[:/]"
+  pattern: "https?://(?!(?:127|10|0)\\.|192\\.168\\.|169\\.254\\.|172\\.(?:1[6-9]|2\\d|3[01])\\.)\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}[:/]"
   match_on: url
-  title: "Direct IP address URL (potential C2 or staging server)"
+  title: "Direct public IP address URL (potential C2 or staging server)"
   expires_at: null
   revoked: false