Skip to content

Commit c50206f

Browse files
prekshivyasclaude
prekshivyas
and
claude
authored
feat(security): block secret writes into persistent workspace memory (NVIDIA#1632)
## Summary - Registers a `before_tool_call` plugin hook that blocks write/edit/apply_patch/notebook_edit tool calls to persistent memory paths when secrets are detected - 14 high-confidence secret patterns: NVIDIA, OpenAI, Anthropic, GitHub, AWS, Slack, Discord, npm, Telegram, Google, HuggingFace tokens, private keys (PEM), authorization headers - Protected paths: `.openclaw-data/memory/`, `workspace/`, `agents/`, `skills/`, `hooks/`, `MEMORY.md` - Hook registration wrapped in try/catch so scanner failures cannot break plugin startup - Non-memory paths and clean content pass through unchanged Closes NVIDIA#1233 ## Test plan - [x] 21 unit tests for secret patterns (true positives, false positives, redaction, path matching) - [x] 9 integration tests for hook wiring (blocks secrets in memory, allows clean content, allows non-memory paths, handles missing events) - [x] TypeScript build passes - [x] All 272 plugin tests pass - [x] All 954 CLI tests pass - [x] gitleaks + detect-private-key hooks pass (test fixtures use runtime-assembled strings) - [x] Manual test: verify blocked write shows actionable error in agent session 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Automatic secret scanner that blocks write-like operations to persistent memory/workspace paths when high-confidence credentials are detected, returns an actionable block reason, and logs a security warning. Matches are redacted in reports. * **Documentation** * Added guidance describing the scanner, covered locations, and observable blocking behavior. * **Tests** * Added tests for secret detection, memory-path checks, blocking behavior, and warning logs. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent 2154b30 commit c50206f

13 files changed

Lines changed: 682 additions & 21 deletions

File tree

‎.agents/skills/nemoclaw-user-configure-security/references/best-practices.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -415,6 +415,19 @@ The CLI automatically redacts secret patterns (API keys, bearer tokens, provider
415415
| Risk if relaxed | Without redaction, secrets could appear in terminal scrollback, log files, or debug output shared in bug reports. |
416416
| Recommendation | No action needed. If you share `nemoclaw debug` output, verify that no secrets appear in the collected diagnostics. |
417417

418+
### Memory Secret Scanner
419+
420+
The NemoClaw plugin blocks the agent from writing likely secrets (API keys, tokens, private keys) into persistent memory files.
421+
The scanner intercepts Write, Edit, and similar tool calls targeting memory and workspace paths before they reach disk.
422+
423+
| Aspect | Detail |
424+
|---|---|
425+
| Default | Enabled. The plugin registers a `before_tool_call` hook that scans for 14 high-confidence secret patterns. |
426+
| What it covers | `.openclaw-data/memory/`, `workspace/`, `agents/`, `skills/`, `hooks/`, and `MEMORY.md`. |
427+
| What you can change | This is not a user-facing knob. The plugin enforces it automatically. |
428+
| Risk if relaxed | Without scanning, the agent could persist API keys or tokens in memory files that survive across sessions and backups. |
429+
| Recommendation | No action needed. If a write is blocked, the agent receives an actionable error listing the detected patterns. |
430+
418431
## Inference Controls
419432

420433
OpenShell routes all inference traffic through the gateway to isolate provider credentials from the sandbox.
@@ -503,6 +516,14 @@ The following patterns weaken security without providing meaningful benefit.
503516
| Adding inference provider hosts to the network policy | Direct network access to an inference host bypasses credential isolation and usage tracking. | Use OpenShell inference routing instead of adding hosts like `api.openai.com` or `api.anthropic.com` to the network policy. |
504517
| Disabling device auth for remote deployments | Without device auth, any device on the network can connect to the gateway without pairing. Combined with a cloudflared tunnel, this makes the dashboard publicly accessible and unauthenticated. | Keep `NEMOCLAW_DISABLE_DEVICE_AUTH` at its default (`0`). Only set it to `1` for local headless or development environments. |
505518

519+
## Known Limitations
520+
521+
| Limitation | Impact | Mitigation |
522+
|-----------|--------|------------|
523+
| `openclaw agent --local` bypasses gateway | Secret scanning, network policy, and inference auth are not enforced when the agent runs in local mode. | A runtime warning is emitted when `--local` is detected. Avoid `--local` for production workflows. A future OpenClaw-level hook will close this gap. |
524+
| Direct filesystem writes bypass secret scanner | The scanner intercepts OpenClaw tool calls, not raw filesystem writes (e.g., `echo secret > file`). | Landlock restricts writable paths. The scanner is application-layer defense-in-depth, not a filesystem-level control. |
525+
| Base64/hex-encoded secrets are not detected | Content-based regex scanning cannot detect encoded or obfuscated secrets. | Use environment variables or credential stores instead of writing secrets to files. |
526+
506527
## Related Topics
507528

508529
- Network Policies (see the `nemoclaw-user-reference` skill) for the full baseline policy reference.

‎.agents/skills/nemoclaw-user-overview/SKILL.md‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
name: "nemoclaw-user-overview"
3-
description: "Explains how OpenClaw, OpenShell, and NemoClaw form the ecosystem, NemoClaw's position in the stack, what NemoClaw adds beyond the community sandbox, and when to prefer NemoClaw versus integrating OpenShell and OpenClaw directly. Use when users ask about the relationship between OpenClaw, OpenShell, and NemoClaw, or when to use NemoClaw versus OpenShell. Describes how NemoClaw works internally: CLI, plugin, blueprint runner, OpenShell orchestration, inference routing, and protection layers. Use for sandbox lifecycle and architecture mechanics; not for product definition (Overview) or multi-project placement (Ecosystem). Explains what NemoClaw covers: onboarding, lifecycle management, and management of OpenClaw within OpenShell containers, plus capabilities and why it exists. Use when users ask what NemoClaw is or what the project provides. For ecosystem placement or OpenShell-only paths, use the Ecosystem page; for internal mechanics, use How It Works. Lists changelogs and feature history for NemoClaw rel..."
3+
description: "Explains how OpenClaw, OpenShell, and NemoClaw form the ecosystem, NemoClaw's position in the stack, what NemoClaw adds beyond the community sandbox, and when to prefer NemoClaw versus integrating OpenShell and OpenClaw directly. Use when users ask about the relationship between OpenClaw, OpenShell, and NemoClaw, or when to use NemoClaw versus OpenShell. Describes how NemoClaw works internally: CLI, plugin, blueprint runner, OpenShell orchestration, inference routing, and protection layers. Use for sandbox lifecycle and architecture mechanics; not for product definition (Overview) or multi-project placement (Ecosystem). Explains what NemoClaw covers: onboarding, lifecycle management, and OpenClaw operations within OpenShell containers, plus capabilities and why it exists. Use when users ask what NemoClaw is or what the project provides. For ecosystem placement or OpenShell-only paths, use the Ecosystem page; for internal mechanics, use How It Works. Lists changelogs and feature history for NemoClaw releas..."
44
---
55

66
<!-- SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -->
@@ -12,7 +12,7 @@ Explains how OpenClaw, OpenShell, and NemoClaw form the ecosystem, NemoClaw's po
1212

1313
## Context
1414

15-
NemoClaw provides onboarding, lifecycle management, and management of OpenClaw within OpenShell containers.
15+
NemoClaw provides onboarding, lifecycle management, and OpenClaw operations within OpenShell containers.
1616

1717
This page describes how the ecosystem is formed across projects, where NemoClaw sits relative to [OpenShell](https://github.com/NVIDIA/OpenShell) and [OpenClaw](https://openclaw.ai), and how to choose between NemoClaw and OpenShell.
1818

@@ -138,12 +138,12 @@ NemoClaw architecture follows the following principles.
138138

139139
*Full details in `references/how-it-works.md`.*
140140

141-
NVIDIA NemoClaw is an open source reference stack that simplifies running [OpenClaw](https://openclaw.ai) always-on assistants.
142-
NemoClaw provides onboarding, lifecycle management, and management of OpenClaw within OpenShell containers.
141+
NVIDIA NemoClaw is an open-source reference stack that simplifies running [OpenClaw](https://openclaw.ai) always-on assistants.
142+
NemoClaw provides onboarding, lifecycle management, and OpenClaw operations within OpenShell containers.
143143
It incorporates policy-based privacy and security guardrails, giving you control over your agents’ behavior and data handling.
144144
This enables self-evolving claws to run more safely in clouds, on prem, RTX PCs and DGX Spark.
145145

146-
NemoClaw pairs open source and hosted models (for example [NVIDIA Nemotron](https://build.nvidia.com)) with a hardened sandbox, routed inference, and declarative egress policy so deployment stays safer and more repeatable.
146+
NemoClaw pairs open-source and hosted models (for example [NVIDIA Nemotron](https://build.nvidia.com)) with a hardened sandbox, routed inference, and declarative egress policy so deployment stays safer and more repeatable.
147147
The sandbox runtime comes from [NVIDIA OpenShell](https://github.com/NVIDIA/OpenShell); NemoClaw adds the blueprint, `nemoclaw` CLI, onboarding, and related tooling as the reference way to run OpenClaw there.
148148

149149
| Capability | Description |

‎.agents/skills/nemoclaw-user-overview/references/ecosystem.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
<!-- SPDX-License-Identifier: Apache-2.0 -->
33
# Ecosystem
44

5-
NemoClaw provides onboarding, lifecycle management, and management of OpenClaw within OpenShell containers.
5+
NemoClaw provides onboarding, lifecycle management, and OpenClaw operations within OpenShell containers.
66

77
This page describes how the ecosystem is formed across projects, where NemoClaw sits relative to [OpenShell](https://github.com/NVIDIA/OpenShell) and [OpenClaw](https://openclaw.ai), and how to choose between NemoClaw and OpenShell.
88

‎.agents/skills/nemoclaw-user-overview/references/overview.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,12 @@
22
<!-- SPDX-License-Identifier: Apache-2.0 -->
33
# Overview
44

5-
NVIDIA NemoClaw is an open source reference stack that simplifies running [OpenClaw](https://openclaw.ai) always-on assistants.
6-
NemoClaw provides onboarding, lifecycle management, and management of OpenClaw within OpenShell containers.
5+
NVIDIA NemoClaw is an open-source reference stack that simplifies running [OpenClaw](https://openclaw.ai) always-on assistants.
6+
NemoClaw provides onboarding, lifecycle management, and OpenClaw operations within OpenShell containers.
77
It incorporates policy-based privacy and security guardrails, giving you control over your agents’ behavior and data handling.
88
This enables self-evolving claws to run more safely in clouds, on prem, RTX PCs and DGX Spark.
99

10-
NemoClaw pairs open source and hosted models (for example [NVIDIA Nemotron](https://build.nvidia.com)) with a hardened sandbox, routed inference, and declarative egress policy so deployment stays safer and more repeatable.
10+
NemoClaw pairs open-source and hosted models (for example [NVIDIA Nemotron](https://build.nvidia.com)) with a hardened sandbox, routed inference, and declarative egress policy so deployment stays safer and more repeatable.
1111
The sandbox runtime comes from [NVIDIA OpenShell](https://github.com/NVIDIA/OpenShell); NemoClaw adds the blueprint, `nemoclaw` CLI, onboarding, and related tooling as the reference way to run OpenClaw there.
1212

1313
| Capability | Description |

‎docs/about/ecosystem.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ status: published
2222

2323
# Ecosystem
2424

25-
NemoClaw provides onboarding, lifecycle management, and management of OpenClaw within OpenShell containers.
25+
NemoClaw provides onboarding, lifecycle management, and OpenClaw operations within OpenShell containers.
2626

2727
This page describes how the ecosystem is formed across projects, where NemoClaw sits relative to [OpenShell](https://github.com/NVIDIA/OpenShell) and [OpenClaw](https://openclaw.ai), and how to choose between NemoClaw and OpenShell.
2828

‎docs/about/overview.md‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@ title:
33
page: "NemoClaw Overview: What It Is"
44
nav: "Overview"
55
description:
6-
main: "NemoClaw is an open source reference stack that simplifies running OpenClaw always-on assistants more safely."
7-
agent: "Explains what NemoClaw covers: onboarding, lifecycle management, and management of OpenClaw within OpenShell containers, plus capabilities and why it exists. Use when users ask what NemoClaw is or what the project provides. For ecosystem placement or OpenShell-only paths, use the Ecosystem page; for internal mechanics, use How It Works."
6+
main: "NemoClaw is an open-source reference stack that simplifies running OpenClaw always-on assistants more safely."
7+
agent: "Explains what NemoClaw covers: onboarding, lifecycle management, and OpenClaw operations within OpenShell containers, plus capabilities and why it exists. Use when users ask what NemoClaw is or what the project provides. For ecosystem placement or OpenShell-only paths, use the Ecosystem page; for internal mechanics, use How It Works."
88
keywords: ["nemoclaw overview", "openclaw always-on assistants", "nvidia openshell", "nvidia nemotron"]
99
topics: ["generative_ai", "ai_agents"]
1010
tags: ["openclaw", "openshell", "sandboxing", "inference_routing", "blueprints"]
@@ -22,12 +22,12 @@ status: published
2222

2323
# Overview
2424

25-
NVIDIA NemoClaw is an open source reference stack that simplifies running [OpenClaw](https://openclaw.ai) always-on assistants.
26-
NemoClaw provides onboarding, lifecycle management, and management of OpenClaw within OpenShell containers.
25+
NVIDIA NemoClaw is an open-source reference stack that simplifies running [OpenClaw](https://openclaw.ai) always-on assistants.
26+
NemoClaw provides onboarding, lifecycle management, and OpenClaw operations within OpenShell containers.
2727
It incorporates policy-based privacy and security guardrails, giving you control over your agents’ behavior and data handling.
2828
This enables self-evolving claws to run more safely in clouds, on prem, RTX PCs and DGX Spark.
2929

30-
NemoClaw pairs open source and hosted models (for example [NVIDIA Nemotron](https://build.nvidia.com)) with a hardened sandbox, routed inference, and declarative egress policy so deployment stays safer and more repeatable.
30+
NemoClaw pairs open-source and hosted models (for example [NVIDIA Nemotron](https://build.nvidia.com)) with a hardened sandbox, routed inference, and declarative egress policy so deployment stays safer and more repeatable.
3131
The sandbox runtime comes from [NVIDIA OpenShell](https://github.com/NVIDIA/OpenShell); NemoClaw adds the blueprint, `nemoclaw` CLI, onboarding, and related tooling as the reference way to run OpenClaw there.
3232

3333
| Capability | Description |

‎docs/index.md‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@ title:
33
page: "NVIDIA NemoClaw Developer Guide"
44
nav: "NemoClaw"
55
description:
6-
main: "NemoClaw is an open source reference stack that simplifies running OpenClaw always-on assistants more safely, with a single command."
7-
agent: "Provides an open source reference stack that simplifies running OpenClaw always-on assistants more safely. Use when setting up NemoClaw, exploring the project, or looking for the landing page."
6+
main: "NemoClaw is an open-source reference stack that simplifies running OpenClaw always-on assistants more safely, with a single command."
7+
agent: "Provides an open-source reference stack that simplifies running OpenClaw always-on assistants more safely. Use when setting up NemoClaw, exploring the project, or looking for the landing page."
88
keywords: ["nemoclaw open source reference stack", "openclaw always-on assistants", "nvidia openshell", "nvidia nemotron"]
99
topics: ["generative_ai", "ai_agents"]
1010
tags: ["openclaw", "openshell", "sandboxing", "inference_routing", "nemoclaw"]
@@ -27,9 +27,9 @@ status: published
2727
:end-before: <!-- end-badges -->
2828
```
2929

30-
NVIDIA NemoClaw is an open source reference stack that simplifies running [OpenClaw](https://openclaw.ai) always-on assistants more safely.
31-
NemoClaw provides onboarding, lifecycle management, and management of OpenClaw within OpenShell containers.
32-
It installs the [NVIDIA OpenShell](https://github.com/NVIDIA/OpenShell) runtime, part of NVIDIA Agent Toolkit, an environment designed for executing claws with additional security, and open source models like [NVIDIA Nemotron](https://build.nvidia.com).
30+
NVIDIA NemoClaw is an open-source reference stack that simplifies running [OpenClaw](https://openclaw.ai) always-on assistants more safely.
31+
NemoClaw provides onboarding, lifecycle management, and OpenClaw operations within OpenShell containers.
32+
It installs the [NVIDIA OpenShell](https://github.com/NVIDIA/OpenShell) runtime, part of NVIDIA Agent Toolkit, an environment designed for executing claws with additional security, and open-source models like [NVIDIA Nemotron](https://build.nvidia.com).
3333

3434
## Get Started
3535

‎docs/security/best-practices.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -435,6 +435,19 @@ The CLI automatically redacts secret patterns (API keys, bearer tokens, provider
435435
| Risk if relaxed | Without redaction, secrets could appear in terminal scrollback, log files, or debug output shared in bug reports. |
436436
| Recommendation | No action needed. If you share `nemoclaw debug` output, verify that no secrets appear in the collected diagnostics. |
437437

438+
### Memory Secret Scanner
439+
440+
The NemoClaw plugin blocks the agent from writing likely secrets (API keys, tokens, private keys) into persistent memory files.
441+
The scanner intercepts Write, Edit, and similar tool calls targeting memory and workspace paths before they reach disk.
442+
443+
| Aspect | Detail |
444+
|---|---|
445+
| Default | Enabled. The plugin registers a `before_tool_call` hook that scans for 14 high-confidence secret patterns. |
446+
| What it covers | `.openclaw-data/memory/`, `workspace/`, `agents/`, `skills/`, `hooks/`, and `MEMORY.md`. |
447+
| What you can change | This is not a user-facing knob. The plugin enforces it automatically. |
448+
| Risk if relaxed | Without scanning, the agent could persist API keys or tokens in memory files that survive across sessions and backups. |
449+
| Recommendation | No action needed. If a write is blocked, the agent receives an actionable error listing the detected patterns. |
450+
438451
## Inference Controls
439452

440453
OpenShell routes all inference traffic through the gateway to isolate provider credentials from the sandbox.
@@ -523,6 +536,14 @@ The following patterns weaken security without providing meaningful benefit.
523536
| Adding inference provider hosts to the network policy | Direct network access to an inference host bypasses credential isolation and usage tracking. | Use OpenShell inference routing instead of adding hosts like `api.openai.com` or `api.anthropic.com` to the network policy. |
524537
| Disabling device auth for remote deployments | Without device auth, any device on the network can connect to the gateway without pairing. Combined with a cloudflared tunnel, this makes the dashboard publicly accessible and unauthenticated. | Keep `NEMOCLAW_DISABLE_DEVICE_AUTH` at its default (`0`). Only set it to `1` for local headless or development environments. |
525538

539+
## Known Limitations
540+
541+
| Limitation | Impact | Mitigation |
542+
|-----------|--------|------------|
543+
| `openclaw agent --local` bypasses gateway | Secret scanning, network policy, and inference auth are not enforced when the agent runs in local mode. | A runtime warning is emitted when `--local` is detected. Avoid `--local` for production workflows. A future OpenClaw-level hook will close this gap. |
544+
| Direct filesystem writes bypass secret scanner | The scanner intercepts OpenClaw tool calls, not raw filesystem writes (e.g., `echo secret > file`). | Landlock restricts writable paths. The scanner is application-layer defense-in-depth, not a filesystem-level control. |
545+
| Base64/hex-encoded secrets are not detected | Content-based regex scanning cannot detect encoded or obfuscated secrets. | Use environment variables or credential stores instead of writing secrets to files. |
546+
526547
## Related Topics
527548

528549
- [Network Policies](../reference/network-policies.md) for the full baseline policy reference.

0 commit comments

Comments
 (0)