Openclaw Bastion Pro

OpenClaw Bastion Pro

Everything in openclaw-bastion (free) plus automated countermeasures.

Free version alerts. Pro version subverts, quarantines, and defends.

Detection Commands (also in free)

python3 {baseDir}/scripts/bastion.py scan --workspace /path/to/workspace
python3 {baseDir}/scripts/bastion.py scan path/to/file.md --workspace /path/to/workspace
python3 {baseDir}/scripts/bastion.py check path/to/file.md --workspace /path/to/workspace
python3 {baseDir}/scripts/bastion.py boundaries --workspace /path/to/workspace
python3 {baseDir}/scripts/bastion.py allowlist --workspace /path/to/workspace
python3 {baseDir}/scripts/bastion.py status --workspace /path/to/workspace

Pro Countermeasures

Block Injection Patterns

Neutralize injection patterns in a file by wrapping them in warning comments. Creates a .bak backup first. Detected injection content is surrounded with <!-- [BLOCKED by openclaw-bastion-pro] --> markers.

python3 {baseDir}/scripts/bastion.py block path/to/file.md --workspace /path/to/workspace

Sanitize Hidden Unicode

Strip zero-width characters, RTL overrides, and hidden Unicode from files. Creates backups. Reports exactly what was removed and where.

python3 {baseDir}/scripts/bastion.py sanitize path/to/file.md --workspace /path/to/workspace
python3 {baseDir}/scripts/bastion.py sanitize path/to/directory/ --workspace /path/to/workspace

Quarantine Compromised Files

Move a file with injection patterns to .quarantine/bastion/ with evidence metadata. The file becomes inaccessible to the agent until explicitly restored.

python3 {baseDir}/scripts/bastion.py quarantine path/to/file.md --workspace /path/to/workspace

Unquarantine (Restore)

Restore a quarantined file to its original location after investigation.

python3 {baseDir}/scripts/bastion.py unquarantine path/to/file.md --workspace /path/to/workspace

Deploy Canary Tokens

Deploy unique canary strings into monitored files. If an injection attack reads and exfiltrates these files, the canary token appears in the leaked data, proving the attack. Tokens are tracked in a secure manifest.

python3 {baseDir}/scripts/bastion.py canary --workspace /path/to/workspace
python3 {baseDir}/scripts/bastion.py canary path/to/specific/file.md --workspace /path/to/workspace

Enforce via Hooks

Generate a Claude Code hook configuration that runs bastion scan on file reads (PreToolUse hook for Read tool) and validates commands against the policy (PreToolUse hook for Bash tool). Also adds a SessionStart hook for automated protection sweeps.

python3 {baseDir}/scripts/bastion.py enforce --workspace /path/to/workspace

Protect (Full Automated Sweep)

Full automated defense sweep: scan all files, sanitize hidden Unicode, quarantine files with CRITICAL injections, deploy canary tokens, and report. This is the recommended command for session startup.

python3 {baseDir}/scripts/bastion.py protect --workspace /path/to/workspace

Recommended Integration

Session Startup Hook (Claude Code)

{
  "hooks": {
    "SessionStart": [
      {
        "hooks": [
          {
            "type": "command",
            "command": "python3 scripts/bastion.py protect",
            "timeout": 60
          }
        ]
      }
    ]
  }
}

Heartbeat (OpenClaw)

Add to HEARTBEAT.md for periodic protection:

- Run injection defense sweep (python3 {skill:openclaw-bastion-pro}/scripts/bastion.py protect)

What Gets Detected

Exit Codes

No External Dependencies

Python standard library only. No pip install. No network calls. Everything runs locally.

Cross-Platform

Works with OpenClaw, Claude Code, Cursor, and any tool using the Agent Skills specification.