openclaw-sentinel 0.2.1 → 0.3.1

package/dist/analyzer.d.ts

@@ -25,4 +25,4 @@ export declare function analyzeFileEvents(rows: Record<string, string>[]): Secur
 /**
  * Format a security event for human-readable alerting.
  */
-export declare function formatAlert(evt: SecurityEvent): string;
+export declare function formatAlert(evt: SecurityEvent, assessment?: string | null): string;

package/dist/analyzer.js

@@ -48,11 +48,15 @@ export function analyzeProcessEvents(rows, config) {
             events.push(event("high", "privilege", "Privilege escalation detected", `Process escalated to root: ${path}\nUser: ${username} (uid=${uid}, euid=0)\nCommand: ${cmdline}`, { path, cmdline, uid, euid, username, signingId }));
             continue;
         }
-        // MEDIUM: Suspicious command patterns
+        // Skip commands matching trusted patterns (e.g. OpenClaw heartbeat scripts)
+        const trustedCmdPatterns = (config.trustedCommandPatterns ?? []).map((p) => new RegExp(p, "i"));
+        if (trustedCmdPatterns.some((p) => p.test(cmdline)))
+            continue;
+        // Suspicious command patterns — only flag actually dangerous imports/tools
         const suspiciousPatterns = [
             /curl.*\|.*sh/i,
             /wget.*\|.*sh/i,
-            /python.*-c.*import/i,
+            /python.*-c.*import\s+(os|subprocess|socket|pty|shutil|ctypes)/i,
             /base64.*decode/i,
             /nc\s+-l/i,
             /ncat.*-l/i,
@@ -61,7 +65,17 @@ export function analyzeProcessEvents(rows, config) {
             /mkfifo/i,
         ];
         if (suspiciousPatterns.some((p) => p.test(cmdline))) {
-            events.push(event("high", "process", "Suspicious command detected", `Potentially malicious command: ${cmdline}\nProcess: ${path}\nUser: ${username}`, { path, cmdline, uid, username }));
+            // Detect likely OpenClaw-spawned commands: safe python one-liners,
+            // curl to known APIs, etc. run by the host user. Downgrade to low.
+            const safeAgentPatterns = [
+                /python.*-c.*import\s+(json|sys|csv|re|datetime|warnings|urllib|http|pathlib|hashlib|hmac|base64|time|math|collections|itertools|functools|textwrap|string|io|copy)/i,
+                /python.*-c.*from\s+(google|googleapiclient|oauth2client|service_account)/i,
+                /curl.*-[sS].*(-H\s+["']Authorization|api\.|sentry\.io|helpscout\.net|trusthub\.twilio|ngpvan\.com|github\.com|slack\.com)/i,
+                /bq\s+(query|ls|show|head|mk)/i,
+                /gh\s+(api|pr|issue|run)/i,
+            ];
+            const isLikelyAgent = safeAgentPatterns.some((p) => p.test(cmdline));
+            events.push(event(isLikelyAgent ? "low" : "high", "process", "Suspicious command detected", `Potentially malicious command: ${cmdline}\nProcess: ${path}\nUser: ${username}`, { path, cmdline, uid, username, likelyAgent: isLikelyAgent }));
         }
     }
     return events;
@@ -167,7 +181,7 @@ export function analyzeFileEvents(rows) {
 /**
  * Format a security event for human-readable alerting.
  */
-export function formatAlert(evt) {
+export function formatAlert(evt, assessment) {
     const severityEmoji = {
         critical: "🚨",
         high: "🔴",
@@ -177,11 +191,15 @@ export function formatAlert(evt) {
     };
     const emoji = severityEmoji[evt.severity];
     const time = new Date(evt.timestamp).toLocaleTimeString();
-    return [
+    const lines = [
         `${emoji} **SENTINEL: ${evt.title}**`,
         `Severity: ${evt.severity.toUpperCase()} | ${evt.category}`,
         `Host: ${evt.hostname} | ${time}`,
         "",
         evt.description,
-    ].join("\n");
+    ];
+    if (assessment) {
+        lines.push("", `🦞 ${assessment}`);
+    }
+    return lines.join("\n");
 }

package/dist/config.d.ts

@@ -17,7 +17,10 @@ export interface SentinelConfig {
     enableNetworkMonitor?: boolean;
     trustedSigningIds?: string[];
     trustedPaths?: string[];
+    trustedCommandPatterns?: string[];
     watchPaths?: string[];
+    /** Add a one-line LLM assessment to alerts before sending (requires openclaw CLI) */
+    llmAlertAssessment?: boolean;
 }
 export declare const DEFAULT_CONFIG: Required<Pick<SentinelConfig, "pollIntervalMs" | "enableProcessMonitor" | "enableFileIntegrity" | "enableNetworkMonitor" | "trustedSigningIds" | "trustedPaths" | "watchPaths">>;
 /** A security event detected by Sentinel */

package/dist/index.js

@@ -93,6 +93,51 @@ async function checkDaemon(sentinelDir) {
         return false;
     }
 }
+/**
+ * Use the LLM (via openclaw CLI) to generate a one-line human-readable
+ * assessment of a security event. Returns the assessment string, or null
+ * on failure.
+ */
+async function llmAssessEvent(evt) {
+    const details = typeof evt.details === "string" ? evt.details : JSON.stringify(evt.details);
+    const prompt = `You are a security-savvy AI agent named Claw monitoring your human's machine. A security event was detected:
+
+Title: ${evt.title}
+Severity: ${evt.severity}
+Category: ${evt.category}
+Description: ${evt.description}
+Details: ${details}
+
+Context: This machine runs OpenClaw (an AI assistant platform) which frequently spawns commands via heartbeats, cron jobs, and agent tasks — python one-liners, curl/wget API calls, bq queries, git, npm/node, etc. The user is "sunil".
+
+Reply with ONLY a single short sentence (under 30 words) giving your honest take on whether this is a real problem or likely benign. Be direct, opinionated, and useful — like a senior engineer glancing at an alert. No preamble.`;
+    try {
+        const { stdout } = await execFileAsync("openclaw", ["agent", "--agent", "main", "--message", prompt, "--json"], {
+            timeout: 30_000,
+        });
+        // Parse JSON response — openclaw agent --json returns { result: { payloads: [{ text: "..." }] } }
+        try {
+            // Skip any non-JSON prefix lines (e.g. "Config warnings:...")
+            const jsonStart = stdout.indexOf("{");
+            const jsonStr = jsonStart >= 0 ? stdout.slice(jsonStart) : stdout;
+            const parsed = JSON.parse(jsonStr.trim());
+            const text = parsed?.result?.payloads?.[0]?.text
+                ?? parsed?.message
+                ?? parsed?.text
+                ?? null;
+            return typeof text === "string" ? text.trim().slice(0, 200) : null;
+        }
+        catch {
+            // Fallback: treat raw stdout as the response
+            const clean = stdout.replace(/^Config warnings:.*\n?/gm, "").trim();
+            return clean.slice(0, 200) || null;
+        }
+    }
+    catch (err) {
+        console.warn(`[sentinel] LLM assessment failed: ${err?.message ?? err}`);
+        return null;
+    }
+}
 /**
  * Handle an osquery result batch — route to appropriate analyzer.
  */
@@ -126,7 +171,21 @@ function handleResult(result, config, sendAlert) {
             if (suppressed) {
                 console.log(`[sentinel] Alert suppressed by rule "${suppressed.reason}" (${SuppressionStore.describe(suppressed)})`);
             }
+            else if (config.llmAlertAssessment) {
+                // Get LLM assessment and include it in the alert
+                console.log(`[sentinel] LLM assessment enabled, calling for: ${evt.title}`);
+                llmAssessEvent(evt).then((assessment) => {
+                    console.log(`[sentinel] LLM assessment result: ${assessment?.slice(0, 80) ?? "(null)"}`);
+                    sendAlert(formatAlert(evt, assessment)).catch((err) => {
+                        console.error("[sentinel] alert failed:", err);
+                    });
+                }).catch((err) => {
+                    console.warn(`[sentinel] LLM assessment promise rejected: ${err}`);
+                    sendAlert(formatAlert(evt)).catch(() => { });
+                });
+            }
             else {
+                console.log(`[sentinel] LLM assessment NOT enabled (llmAlertAssessment=${config.llmAlertAssessment})`);
                 sendAlert(formatAlert(evt)).catch((err) => {
                     console.error("[sentinel] alert failed:", err);
                 });
@@ -151,7 +210,7 @@ export default function sentinel(api) {
     }
     catch { /* ignore */ }
     const pluginConfig = { ...fileConfig, ...apiConfig };
-    console.log(`[sentinel] Config: alertSeverity=${pluginConfig.alertSeverity}, alertChannel=${pluginConfig.alertChannel}`);
+    console.log(`[sentinel] Config v0.3.0: alertSeverity=${pluginConfig.alertSeverity}, alertChannel=${pluginConfig.alertChannel}, llmAssess=${pluginConfig.llmAlertAssessment}, trustedPatterns=${(pluginConfig.trustedCommandPatterns ?? []).length}`);
     let watcher = null;
     let logStreamWatcher = null;
     const sentinelDir = pluginConfig.logPath ?? SENTINEL_DIR_DEFAULT;
@@ -506,6 +565,15 @@ export default function sentinel(api) {
                     if (suppressed) {
                         console.log(`[sentinel] Alert suppressed by rule "${suppressed.reason}" (${SuppressionStore.describe(suppressed)})`);
                     }
+                    else if (pluginConfig.llmAlertAssessment) {
+                        llmAssessEvent(evt).then((assessment) => {
+                            sendAlert(formatAlert(evt, assessment)).catch((err) => {
+                                console.error("[sentinel] alert failed:", err);
+                            });
+                        }).catch(() => {
+                            sendAlert(formatAlert(evt)).catch(() => { });
+                        });
+                    }
                     else {
                         sendAlert(formatAlert(evt)).catch((err) => {
                             console.error("[sentinel] alert failed:", err);

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "sentinel",
   "name": "Sentinel",
   "description": "Real-time endpoint security monitoring for macOS and Linux — process execution, SSH connections, privilege escalation, and file integrity alerts via OpenClaw.",
-  "version": "0.2.1",
+  "version": "0.3.1",
   "skills": ["skills/sentinel"],
   "configSchema": {
     "type": "object",
@@ -61,10 +61,19 @@
         "items": { "type": "string" },
         "description": "Process paths to trust (skip alerts for these)"
       },
+      "trustedCommandPatterns": {
+        "type": "array",
+        "items": { "type": "string" },
+        "description": "Regex patterns for commands to skip (e.g. OpenClaw heartbeat scripts)"
+      },
       "watchPaths": {
         "type": "array",
         "items": { "type": "string" },
         "description": "File paths to monitor for integrity changes"
+      },
+      "llmAlertAssessment": {
+        "type": "boolean",
+        "description": "Use LLM to assess suspicious commands before alerting (reduces false positives from automation)"
       }
     }
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openclaw-sentinel",
-  "version": "0.2.1",
+  "version": "0.3.1",
   "description": "Real-time endpoint security monitoring plugin for OpenClaw",
   "type": "module",
   "main": "dist/index.js",