Community code plugin. Review compatibility and verification before install.
Latest release: v0.14.0Download zip
Compatibility
Security Scan
OpenClaw
Benign
high confidenceCredentials
The plugin performs cloud-backed URL, file, package, telemetry, and skill analysis, and can upload unknown skill folders after a notice unless disabled; this is sensitive but scoped to its security function and disclosed in runtime text/configuration.
Install Mechanism
The package manifest activates the OpenClaw hook extension and does not define install or postinstall scripts; optional koffi support is consistent with Windows AMSI scanning.
Instruction Scope
The bundled security-awareness skill is non-user-invocable guidance that tells agents to avoid risky patterns and not auto-approve flagged actions; I found no prompt override, hidden role change, or unrelated runtime instruction.
Persistence & Privilege
It persists configuration, logs, caches, install state, verdicts, pending skill-upload markers, and user-approved exceptions under ~/.sage, and may spawn short-lived detached workers for model download or skill upload; these are purpose-aligned but privacy-relevant.
Purpose & Capability
The broad OpenClaw hooks, bundled threat rules, reputation checks, audit logging, and approval prompts align with the stated safety purpose of guarding commands, file operations, web requests, packages, and installed skills.
Scan Findings in Context
[SC2] expected: The matched curl/wget pipe strings appear inside defensive guidance that says never to run those patterns, not as executable installation or runtime behavior.
[TM1] expected: The destructive command and chmod examples are warning examples in the security-awareness content and threat rules, consistent with a security scanner.
[PE3] expected: References to /etc/passwd, .ssh, and private keys are cautionary examples and detection targets, not code that reads those files.
[EA2] expected: The text explicitly warns not to auto-approve without user confirmation and the plugin uses native approval prompts for ask decisions.
[PE2] expected: chmod 777 and sudoers references are file-permission warnings, not elevation commands executed by the artifact.
[TM3] expected: World-writable permission references are safe-practice guidance and detection content, not unsafe defaults created by the package.
Assessment
Install only if you are comfortable with a security plugin inspecting agent tool calls and installed plugin/skill content. Review ~/.sage/config.json after install, especially skill_check.upload_enabled and community_iq, if you want to limit cloud uploads or telemetry.dist/index.cjs:14916
Shell command execution detected (child_process).
dist/mcp-server.cjs:16688
Dynamic code execution detected.
dist/index.cjs:4488
Environment variable access combined with network send.
dist/mcp-server.cjs:4587
Environment variable access combined with network send.
dist/model-download-worker.cjs:1079
Environment variable access combined with network send.
dist/index.cjs.map:4
File appears to expose a hardcoded API secret or token.
dist/mcp-server.cjs.map:4
File appears to expose a hardcoded API secret or token.
dist/skill-upload-worker.cjs.map:4
File appears to expose a hardcoded API secret or token.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.Verification
Tags
Sage — Safety for Agents
<p align="center"> <img src="https://raw.githubusercontent.com/gendigitalinc/sage/main/images/logo-shaded.png" alt="Sage" width="250"> </p> <p align="center"> Protect your AI coding agent from dangerous commands, malicious URLs, and harmful file operations. </p><p align="center"> <img src="https://raw.githubusercontent.com/gendigitalinc/sage/main/images/block-openclaw-allow.gif" alt="Sage blocking a dangerous command in OpenClaw" width="700"> </p>
What is Sage?
Sage is a security layer for OpenClaw. It intercepts tool calls — shell commands, URL fetches, file writes — and checks them for threats before they execute. If something looks dangerous, Sage blocks it with a native approval dialog.
What it protects against
- Malicious URLs — phishing, malware, and scam sites detected via cloud reputation
- Dangerous commands — reverse shells, pipe-to-curl, credential theft, data exfiltration
- Prompt injection — heuristics + a fine-tuned ML model detect injected instructions in fetched content
- Suspicious file operations — writes to sensitive paths, credential files, system configs
- Supply-chain attacks — malicious or typosquatted npm/PyPI packages
- Compromised plugins — automatic scanning of installed plugins at session start
Install
See the install guide for step-by-step instructions, or run:
openclaw plugins install @gendigital/sage-openclaw
Sage loads automatically — no configuration needed.
To verify it's working, ask your agent to run
echo diagmark_cmd_a75bf229. Sage should block this harmless canary command.
What Sage intercepts
Sage hooks into OpenClaw's before_tool_call lifecycle:
- exec — shell commands
- write / edit — file modifications
- read — file reads (sensitive paths)
- web_fetch — URL fetches and downloads
- apply_patch — patch application
How it works
When your agent makes a tool call, Sage evaluates it and returns a verdict:
| Verdict | What happens |
|---|---|
| Allow | No threats detected — the action proceeds normally |
| Ask | Suspicious activity — you're prompted via native approval dialog |
| Deny | Threat detected — the action is blocked |
Sage is designed to fail open: if anything goes wrong internally, the action proceeds. Your agent is never blocked due to a Sage error.
Configuration
Sage works out of the box with no configuration. To customize behavior, edit ~/.sage/config.json:
{
"sensitivity": "balanced",
"url_check": { "enabled": true },
"heuristics_enabled": true
}
See Configuration for all options.
Links
- User Guide — verify install, handle alerts, manage false positives
- Configuration — all config options
- Exceptions — pattern-based allow/deny rules
- Privacy — what data is sent, what stays local
- GitHub