openclaw-plugin-vt-sentinel 0.8.4 → 0.8.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/README.md +100 -0
  2. package/dist/index.js +2 -2
  3. package/package.json +15 -2
package/README.md ADDED
@@ -0,0 +1,100 @@
1
+ # VT Sentinel — VirusTotal Security Plugin for OpenClaw
2
+
3
+ Automatic malware detection and AI-powered code analysis for OpenClaw agents.
4
+ Zero-config — no API key needed. Auto-registers with VirusTotal's AI API.
5
+
6
+ ## Install
7
+
8
+ ```
9
+ openclaw plugins install openclaw-plugin-vt-sentinel
10
+ ```
11
+
12
+ Then restart the gateway:
13
+
14
+ ```
15
+ openclaw gateway restart
16
+ ```
17
+
18
+ ## Verify
19
+
20
+ ```
21
+ openclaw plugins list | grep vt-sentinel
22
+ ```
23
+
24
+ Should show 8 tools registered.
25
+
26
+ ## Tools
27
+
28
+ | Tool | Purpose |
29
+ |------|---------|
30
+ | `vt_scan_file` | Full file scan (AV engines + AI Code Insight) |
31
+ | `vt_check_hash` | Quick hash lookup without uploading |
32
+ | `vt_upload_consent` | Manage consent for sensitive file uploads |
33
+ | `vt_sentinel_status` | View config, watched dirs, protection status |
34
+ | `vt_sentinel_configure` | Change settings at runtime (presets, notify level, block mode) |
35
+ | `vt_sentinel_reset_policy` | Reset all settings to defaults |
36
+ | `vt_sentinel_help` | Quick-start guide and privacy info |
37
+ | `vt_sentinel_update` | Check for updates and get upgrade instructions |
38
+
39
+ ## What it does
40
+
41
+ - Scans downloaded and created files automatically (AV + AI Code Insight)
42
+ - Blocks execution of malicious files and dangerous command patterns
43
+ - Monitors directories in real-time (Downloads, /tmp, workspace)
44
+ - Quarantines threats with rotating audit logs
45
+ - Detects TOCTOU attacks, LOLBins, and persistence patterns
46
+
47
+ ## Update
48
+
49
+ If VT Sentinel is already installed, use the built-in update tool:
50
+
51
+ ```
52
+ Ask your agent: "check for VT Sentinel updates"
53
+ ```
54
+
55
+ Or manually:
56
+
57
+ ```
58
+ openclaw gateway stop
59
+ openclaw plugins update openclaw-plugin-vt-sentinel
60
+ openclaw gateway start
61
+ ```
62
+
63
+ ## Configuration
64
+
65
+ ### Optional: Add your own VirusTotal API key (higher rate limits)
66
+
67
+ ```
68
+ openclaw plugins config openclaw-plugin-vt-sentinel apiKey YOUR_KEY
69
+ ```
70
+
71
+ ### Presets
72
+
73
+ | Preset | Description |
74
+ |--------|-------------|
75
+ | `balanced` | Default — scans everything, quarantines threats |
76
+ | `privacy_first` | Hash-only lookups, no file uploads |
77
+ | `strict_security` | Maximum protection, blocks on suspicion |
78
+
79
+ ### Settings
80
+
81
+ | Setting | Values | Default |
82
+ |---------|--------|---------|
83
+ | `notifyLevel` | all, threats_only, silent | all |
84
+ | `blockMode` | quarantine, block_only, log_only | quarantine |
85
+ | `sensitiveFilePolicy` | ask, ask_once, always_upload, hash_only | ask |
86
+ | `maxFileSizeMb` | 1-32 | 32 |
87
+ | `autoScan` | true, false | true |
88
+
89
+ ## How it works
90
+
91
+ VT Sentinel connects to [VTAI](https://ai.virustotal.com) — VirusTotal's LLM-optimized proxy layer. On first run it auto-registers an agent identity and receives a permanent API token. All scans go through VTAI's minimized response format, optimized for LLM context windows.
92
+
93
+ File analysis includes:
94
+ - **AV detections** from 60+ antivirus engines
95
+ - **AI Code Insight** (Gemini-powered semantic analysis)
96
+ - **Crowdsourced AI results** from the VirusTotal community
97
+
98
+ ## License
99
+
100
+ MIT
package/dist/index.js CHANGED
@@ -152,8 +152,8 @@ function generateUpdateCommands(opts) {
152
152
  const singleQuote = (s) => "'" + s.replace(/'/g, "'\\''") + "'";
153
153
  // Double-quote for shell: escape \, ", $, ` (all chars bash expands inside "")
154
154
  const doubleQuote = (s) => '"' + s.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\$/g, '\\$').replace(/`/g, '\\`') + '"';
155
- // For JS string inside shell double-quoted node -e: escape \, ', $, `
156
- const jsInShellDq = (s) => s.replace(/\\/g, '\\\\').replace(/'/g, "\\'").replace(/\$/g, '\\$').replace(/`/g, '\\`');
155
+ // For JS string inside shell double-quoted node -e: escape \, ", ', $, `
156
+ const jsInShellDq = (s) => s.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/'/g, "\\'").replace(/\$/g, '\\$').replace(/`/g, '\\`');
157
157
  const lines = [];
158
158
  lines.push(`Upgrade: v${opts.currentVersion} → v${opts.latestVersion}`);
159
159
  lines.push('');
package/package.json CHANGED
@@ -1,9 +1,17 @@
1
1
  {
2
2
  "name": "openclaw-plugin-vt-sentinel",
3
- "version": "0.8.4",
3
+ "version": "0.8.6",
4
4
  "description": "VirusTotal Sentinel for OpenClaw - Malware detection and AI-powered code analysis",
5
5
  "main": "dist/index.js",
6
6
  "types": "dist/index.d.ts",
7
+ "homepage": "https://ai.virustotal.com",
8
+ "repository": {
9
+ "type": "git",
10
+ "url": "https://github.com/VirusTotal/openclaw-plugin-vt-sentinel"
11
+ },
12
+ "bugs": {
13
+ "url": "https://github.com/VirusTotal/openclaw-plugin-vt-sentinel/issues"
14
+ },
7
15
  "scripts": {
8
16
  "build": "tsc",
9
17
  "watch": "tsc -w",
@@ -11,14 +19,19 @@
11
19
  },
12
20
  "keywords": [
13
21
  "openclaw",
22
+ "openclaw-plugin",
14
23
  "plugin",
15
24
  "security",
16
25
  "virustotal",
17
26
  "malware",
18
- "code-insight"
27
+ "antivirus",
28
+ "code-insight",
29
+ "file-scanner",
30
+ "threat-detection"
19
31
  ],
20
32
  "license": "MIT",
21
33
  "files": [
34
+ "README.md",
22
35
  "dist/index.*",
23
36
  "dist/scanner.*",
24
37
  "dist/vt-api.*",