antgroup / agent-aegis

What it does

• Five-Layer Defense-in-Depth. Covers intent scanning, tool call governance, tool result inspection, asset protection, and output safeguarding across nine OpenClaw lifecycle hooks.
• Skill Poisoning Defense. Scans skill content at startup and continuously, detecting malicious payloads that attempt to bypass approval, disable safety controls, or tamper with protected assets.
• Memory Contamination Guard. Rejects suspicious or oversized writes to persistent memory stores (memory_store, MEMORY.md, SOUL.md, memory/), preventing persistent prompt poisoning across sessions.
• Intent & Prompt Safety. Detects jailbreak attempts, secret-exfiltration requests, and plugin-tampering intent in user messages, then injects safety context into prompts to influence subsequent model reasoning.
• Tool Call Governance. Blocks high-risk shell commands, encoded/obfuscated payloads, write-then-execute chains, repeated mutation loops, and SSRF/exfiltration chains before tool execution.