Community code plugin. Review compatibility and verification before install.
Latest release: v0.11.0Download zip
Compatibility
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The stated purpose is an OpenClaw safety layer for commands, file operations, URLs, package checks, prompt injection, and plugin scanning; the main capabilities fit that purpose.
Instruction Scope
The bundled skill guidance is safety-oriented, but shipped source-map comments say dynamic file/env access is used to avoid OpenClaw false-positive heuristics, which is a material auditability concern for a plugin that also uses network services.
Install Mechanism
Installation is a standard OpenClaw npm plugin with no package-level postinstall script; optional PI checking can later run npm install for onnxruntime-node and download checksum-verified model files.
Credentials
The plugin intercepts high-impact tool calls, scans installed OpenClaw extensions, checks URLs/packages/file hashes/skills with cloud services, and sends default deny-event telemetry containing limited command, URL, package, or file-path content with a persistent installation id.
Persistence & Privilege
It creates persistent state under ~/.sage, including config, cache, audit and operational logs, exceptions, plugin-scan cache, an installation id, and optional models; persistent allow rules require an allow-always approval path.
Scan Findings in Context
[SC2] expected: The cited curl/wget pipe-to-shell strings appear in security guidance warning the agent not to run those patterns, not as instructions to execute remote scripts.
[TM1] expected: The destructive-command strings appear as examples of dangerous behavior to watch for, not as tool parameters the skill asks the agent to run.
[staticScan] expected: Most child_process, dynamic-code, environment, and network matches map to security scanning, bundled libraries, configuration, AMSI/model support, or telemetry; the concern is the artifact-backed scanner-avoidance comments around file/env access.
[VirusTotal] expected: VirusTotal telemetry was clean and does not add a negative signal.
What to consider before installing
Install only if you are comfortable with a security plugin inspecting agent commands, URLs, file paths, write/edit content, and installed plugins; storing local logs and exceptions under ~/.sage; and sending URL/hash/verdict telemetry to Sage/Avast-backed services. Review configuration for community_iq, url_check, file_check, package_check, logging, amsi_check, and pi_check before use.dist/index.cjs:5358
Shell command execution detected (child_process).
dist/mcp-server.cjs:16574
Dynamic code execution detected.
dist/index.cjs:4419
Environment variable access combined with network send.
dist/mcp-server.cjs:4473
Environment variable access combined with network send.
dist/model-download-worker.cjs:1079
Environment variable access combined with network send.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.Verification
Tags
Sage — Safety for Agents
<p align="center"> <img src="https://raw.githubusercontent.com/gendigitalinc/sage/main/images/logo-shaded.png" alt="Sage" width="250"> </p> <p align="center"> Protect your AI coding agent from dangerous commands, malicious URLs, and harmful file operations. </p><p align="center"> <img src="https://raw.githubusercontent.com/gendigitalinc/sage/main/images/block-openclaw-allow.gif" alt="Sage blocking a dangerous command in OpenClaw" width="700"> </p>
What is Sage?
Sage is a security layer for OpenClaw. It intercepts tool calls — shell commands, URL fetches, file writes — and checks them for threats before they execute. If something looks dangerous, Sage blocks it with a native approval dialog.
What it protects against
- Malicious URLs — phishing, malware, and scam sites detected via cloud reputation
- Dangerous commands — reverse shells, pipe-to-curl, credential theft, data exfiltration
- Prompt injection — heuristics + a fine-tuned ML model detect injected instructions in fetched content
- Suspicious file operations — writes to sensitive paths, credential files, system configs
- Supply-chain attacks — malicious or typosquatted npm/PyPI packages
- Compromised plugins — automatic scanning of installed plugins at session start
Install
See the install guide for step-by-step instructions, or run:
openclaw plugins install @gendigital/sage-openclaw
Sage loads automatically — no configuration needed.
To verify it's working, ask your agent to run
echo __sage_test_deny_cmd_a75bf229__. Sage should block this harmless canary command.
What Sage intercepts
Sage hooks into OpenClaw's before_tool_call lifecycle:
- exec — shell commands
- write / edit — file modifications
- read — file reads (sensitive paths)
- web_fetch — URL fetches and downloads
- apply_patch — patch application
How it works
When your agent makes a tool call, Sage evaluates it and returns a verdict:
| Verdict | What happens |
|---|---|
| Allow | No threats detected — the action proceeds normally |
| Ask | Suspicious activity — you're prompted via native approval dialog |
| Deny | Threat detected — the action is blocked |
Sage is designed to fail open: if anything goes wrong internally, the action proceeds. Your agent is never blocked due to a Sage error.
Configuration
Sage works out of the box with no configuration. To customize behavior, edit ~/.sage/config.json:
{
"sensitivity": "balanced",
"url_check": { "enabled": true },
"heuristics_enabled": true
}
See Configuration for all options.
Links
- User Guide — verify install, handle alerts, manage false positives
- Configuration — all config options
- Exceptions — pattern-based allow/deny rules
- Privacy — what data is sent, what stays local
- GitHub