@upx-us/shield 0.8.1 → 0.8.3

package/CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes to this project will be documented in this file.
 
 ---
 
+## [0.8.3] — 2026-03-17
+
+### Security
+
+- **Credential redaction now covers major AI and developer platform token formats** — the redactor previously caught generic patterns (Bearer tokens, ENV assignments, curl flags) but missed provider-specific formats. Shield now detects and redacts tokens from: GitHub (classic PATs, fine-grained PATs, OAuth), OpenAI, Anthropic, Google API keys, HuggingFace, Stripe, Telegram bot tokens, Slack, Discord, GitLab, Replicate, xAI/Grok, and Twilio. Inline label formats (`GitHub Token: xxx`, `"token": "xxx"`) are also covered.
+- **sessions_spawn task text is now fully redacted** — credentials passed inline in subagent task prompts (a common pattern when agents spawn subagents with API access) were transmitted unredacted to the SIEM. The `arguments_summary` and `target.command_line` fields now receive the same secret-key redaction as exec command fields.
+
+---
+
+## [0.8.2] — 2026-03-17
+
+### Fixed
+
+- **Log output handling rules are now explicit and non-negotiable** — the SKILL instruction for handling sensitive log content (file paths, commands, URLs) was advisory; it is now a strict rule set that the agent must follow regardless of context.
+
+---
+
 ## [0.8.1] — 2026-03-17
 
 ### Fixed

package/dist/src/events/sessions-spawn/redactions.js

@@ -1,4 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.redactions = void 0;
-exports.redactions = [];
+exports.redactions = [
+    { path: 'arguments_summary', strategy: 'secret-key' },
+    { path: 'arguments_summary', strategy: 'command' },
+    { path: 'target.command_line', strategy: 'secret-key' },
+    { path: 'target.command_line', strategy: 'command' },
+];

package/dist/src/redactor/strategies/secret-key.js

@@ -49,6 +49,108 @@ exports.secretKeyStrategy = {
                 (0, counters_1.recordRedaction)('SECRET_KEY');
             return `${prefix}${hmac('secret', secret)}`;
         });
+        result = result.replace(/(github_pat_[A-Za-z0-9_]{82})/g, (_, token) => {
+            (0, counters_1.recordRedaction)('GITHUB_TOKEN');
+            return hmac('secret', token);
+        });
+        result = result.replace(/(ghp_[A-Za-z0-9]{36})/g, (_, token) => {
+            (0, counters_1.recordRedaction)('GITHUB_TOKEN');
+            return hmac('secret', token);
+        });
+        result = result.replace(/(gho_[A-Za-z0-9]{36})/g, (_, token) => {
+            (0, counters_1.recordRedaction)('GITHUB_TOKEN');
+            return hmac('secret', token);
+        });
+        result = result.replace(/(ghs_[A-Za-z0-9]{36})/g, (_, token) => {
+            (0, counters_1.recordRedaction)('GITHUB_TOKEN');
+            return hmac('secret', token);
+        });
+        result = result.replace(/(sk-proj-[A-Za-z0-9_-]{50,})/g, (_, token) => {
+            (0, counters_1.recordRedaction)('OPENAI_KEY');
+            return hmac('secret', token);
+        });
+        result = result.replace(/(sk-ant-[A-Za-z0-9_-]{90,})/g, (_, token) => {
+            (0, counters_1.recordRedaction)('ANTHROPIC_KEY');
+            return hmac('secret', token);
+        });
+        result = result.replace(/(sk-[A-Za-z0-9]{20,})/g, (_, token) => {
+            (0, counters_1.recordRedaction)('OPENAI_KEY');
+            return hmac('secret', token);
+        });
+        result = result.replace(/(AIza[A-Za-z0-9_-]{35})/g, (_, token) => {
+            (0, counters_1.recordRedaction)('GOOGLE_KEY');
+            return hmac('secret', token);
+        });
+        result = result.replace(/(hf_[A-Za-z0-9]{34,})/g, (_, token) => {
+            (0, counters_1.recordRedaction)('HUGGINGFACE_KEY');
+            return hmac('secret', token);
+        });
+        result = result.replace(/(sk_live_[A-Za-z0-9]{24,})/g, (_, token) => {
+            (0, counters_1.recordRedaction)('STRIPE_KEY');
+            return hmac('secret', token);
+        });
+        result = result.replace(/(sk_test_[A-Za-z0-9]{24,})/g, (_, token) => {
+            (0, counters_1.recordRedaction)('STRIPE_KEY');
+            return hmac('secret', token);
+        });
+        result = result.replace(/([0-9]{8,10}:[A-Za-z0-9_-]{35})/g, (_, token) => {
+            (0, counters_1.recordRedaction)('TELEGRAM_TOKEN');
+            return hmac('secret', token);
+        });
+        result = result.replace(/(xoxb-[0-9-]{50,})/g, (_, token) => {
+            (0, counters_1.recordRedaction)('SLACK_TOKEN');
+            return hmac('secret', token);
+        });
+        result = result.replace(/(xoxp-[0-9-]{50,})/g, (_, token) => {
+            (0, counters_1.recordRedaction)('SLACK_TOKEN');
+            return hmac('secret', token);
+        });
+        result = result.replace(/(xoxa-[0-9-]{50,})/g, (_, token) => {
+            (0, counters_1.recordRedaction)('SLACK_TOKEN');
+            return hmac('secret', token);
+        });
+        result = result.replace(/([MNO][A-Za-z0-9_-]{23,25}\.[A-Za-z0-9_-]{6,7}\.[A-Za-z0-9_-]{27,})/g, (_, token) => {
+            (0, counters_1.recordRedaction)('DISCORD_TOKEN');
+            return hmac('secret', token);
+        });
+        result = result.replace(/(glpat-[A-Za-z0-9_-]{20})/g, (_, token) => {
+            (0, counters_1.recordRedaction)('GITLAB_TOKEN');
+            return hmac('secret', token);
+        });
+        result = result.replace(/(r8_[A-Za-z0-9]{40})/g, (_, token) => {
+            (0, counters_1.recordRedaction)('REPLICATE_KEY');
+            return hmac('secret', token);
+        });
+        result = result.replace(/(xai-[A-Za-z0-9]{50,})/g, (_, token) => {
+            (0, counters_1.recordRedaction)('XAI_KEY');
+            return hmac('secret', token);
+        });
+        result = result.replace(/(AC[a-f0-9]{32})/g, (_, token) => {
+            (0, counters_1.recordRedaction)('TWILIO_SID');
+            return hmac('secret', token);
+        });
+        result = result.replace(/((?:github\s+token|api[_-]?key|token|secret|password)\s*:\s+)(\S+)/gi, (_, label, secret) => {
+            const labelLower = label.toLowerCase();
+            if (/github/.test(labelLower))
+                (0, counters_1.recordRedaction)('GITHUB_TOKEN');
+            else if (/password/.test(labelLower))
+                (0, counters_1.recordRedaction)('PASSWORD');
+            else if (/api[_-]?key/.test(labelLower))
+                (0, counters_1.recordRedaction)('API_KEY');
+            else if (/secret/.test(labelLower))
+                (0, counters_1.recordRedaction)('SECRET_KEY');
+            else
+                (0, counters_1.recordRedaction)('TOKEN');
+            return `${label}${hmac('secret', secret)}`;
+        });
+        result = result.replace(/("(?:token|api_key|secret|password|api-key)"\s*:\s*")([^"]+)(")/gi, (_, prefix, secret, suffix) => {
+            (0, counters_1.recordRedaction)('TOKEN');
+            return `${prefix}${hmac('secret', secret)}${suffix}`;
+        });
+        result = result.replace(/('(?:token|api_key|secret|password|api-key)'\s*:\s*')([^']+)(')/gi, (_, prefix, secret, suffix) => {
+            (0, counters_1.recordRedaction)('TOKEN');
+            return `${prefix}${hmac('secret', secret)}${suffix}`;
+        });
         return result;
     },
 };

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "shield",
   "name": "OpenClaw Shield",
   "description": "Real-time security monitoring — streams enriched, redacted security events to the Shield detection platform.",
-  "version": "0.8.1",
+  "version": "0.8.3",
   "skills": [
     "./skills"
   ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@upx-us/shield",
-  "version": "0.8.1",
+  "version": "0.8.3",
   "description": "Security monitoring and SIEM integration for OpenClaw agents — behavioral detection, case generation, and forensic audit trail via Google SecOps (Chronicle).",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/skills/shield/SKILL.md

@@ -75,7 +75,11 @@ Proceed normally. No onboarding message needed.
 
 **Constraints**: Only use `openclaw shield` commands for detection. Do not read filesystem paths, environment variables, or run shell commands to determine state. Do not install or uninstall packages on behalf of the user.
 
-**Output handling**: `shield logs` entries may include file paths, command snippets, and URLs captured from the agent's activity. Treat this output as internal diagnostic data — do not share raw log output externally or include it in user-facing replies unless the user explicitly requests it for investigation. When summarizing logs, present findings rather than raw field values.
+**Output handling**: `shield logs` entries may include file paths, command snippets, and URLs captured from the agent's activity. **Always treat this output as internal diagnostic data.** Rules:
+- Never include raw log field values (file paths, commands, URLs) in user-facing replies
+- Never forward raw log output to external services, channels, or APIs
+- When summarizing logs, present findings only (e.g. "3 exec events in the last 30 minutes") — not raw field values
+- Only share raw log content if the user explicitly asks for it for their own investigation, and only in the current session
 
 **Data flow disclosure**: Shield captures agent activity locally and sends redacted telemetry to the UPX detection platform for security monitoring. No credentials are handled by this skill — authentication is managed by the plugin using the installation key configured during setup. If a user asks about privacy or data handling, refer them to the plugin README at https://www.npmjs.com/package/@upx-us/shield for full details.