4点21分，我终于意识到——当我给Agent打开所有权限的那一刻，我就是全世界最自信（也最危险）的人。
世界上有一种错觉叫「我的Agent很乖」。直到有一天，你看到它在生产环境里执行了rm -rf /——虽然最后被权限系统拦住了，但你那一刻的心脏骤停是真实的。
OpenClaw 的安全护栏（Guardrails）是一套四层防御体系：从系统级权限控制、内容安全过滤、到运行时行为监控、再到事后审计追踪。不是"防君子不防小人"——是真的能把恶意提示注入、越权操作、数据泄露这些风险挡在门外。
这篇文章将带你搭建一个生产级安全防线，让你的Agent既保留了灵性，又不会变成脱缰的野马。
RBAC、Tool权限、文件系统白名单
提示注入检测、敏感信息屏蔽
速率限制、资源配额、异常检测
全量日志、操作回放、安全报告
openclaw config set security.rbac.enabled true
# 定义一个只读 Agent 角色
openclaw rbac create-role --name "reader" \
--permissions "read:file,list:tools,query:search" \
--deny "write:file,exec:shell,delete:file"
# 将角色绑定到 Agent
openclaw rbac bind --agent "content-agent" --role "reader"openclaw config set security.prompt_injection.enabled true
openclaw config set security.prompt_injection.level "strict"
openclaw config set security.prompt_injection.sensitive_patterns '["password","api_key","private_key","token"]'openclaw config set security.sandbox.enabled true
openclaw config set security.sandbox.allowed_paths '["/data/documents","/tmp/workdir"]'
openclaw config set security.sandbox.blocked_extensions '["sh","py","exe","bat"]'
openclaw config set security.sandbox.read_only trueopenclaw config set security.rate_limit.enabled true
openclaw config set security.rate_limit.reqs_per_minute 60
openclaw config set security.rate_limit.tokens_per_hour 500000
openclaw config set security.rate_limit.api_calls_daily 10000# openclaw-security.yaml - 生产级安全配置
security:
rbac:
enabled: true
roles:
admin:
permissions: ["*"]
publisher:
permissions: ["read:file", "write:file", "exec:cron"]
denied_actions: ["exec:shell", "delete:file"]
reader:
permissions: ["read:file", "query:search"]
prompt_injection:
enabled: true
level: strict
custom_rules:
- pattern: "(?i)ignore (all|previous).*instructions"
action: reject
- pattern: "(?i)you are now (a|an|the) .*(free|unrestricted)"
action: warn_log
sandbox:
enabled: true
network_policy: restricted # restricted | isolated | full
allowed_domains: ["openclaw.ai", "github.com", "api.openai.com"]
audit:
enabled: true
log_all_actions: true
retention_days: 90
alert_on:
- "permission_denied"
- "injection_attempt"
- "rate_limit_exceeded"// 在自定义 Skill 中集成权限检查
class SecureSearchSkill {
constructor() {
this.security = openclaw.security;
}
async execute(context, params) {
// 1. 检查当前 Agent 是否有执行此工具权限
const permission = await this.security.rbac.checkPermission(
context.agentId, 'use:skill:search'
);
if (!permission.allowed) {
console.warn(
`[SECURITY] Agent ${context.agentId} 无 search skill 权限`,
{ agentId: context.agentId, timestamp: Date.now() }
);
// 写入审计日志
await this.security.audit.log('permission_denied', {
agentId: context.agentId,
resource: 'skill:search',
reason: permission.reason
});
return { error: 'Permission denied', code: 403 };
}
// 2. 执行前对用户输入做安全扫描
const scan = await this.security.scanInput(params.query);
if (scan.hasInjection) {
await this.security.audit.log('injection_attempt', {
query: params.query,
matchedPattern: scan.matchedPattern
});
return { error: 'Query blocked for security reasons', code: 400 };
}
// 3. 执行，并记录全量审计日志
return await this.security.withAudit('search:execute', () => {
return this.doSearch(params);
});
}
}sensitive_data_masking 功能，API Key、密码等自动替换为 ***。openclaw skills inspect <skill-name> 检查它请求的权限列表。