shamash-openclaw 0.4.0

Shamash 4-gate security firewall for OpenClaw — one-command setup for prompt injection, jailbreak, and data exfiltration detection

shamash-openclaw (pip)

Python package wrapper that installs the OpenClaw Shamash plugin and a bundled platform-compatible Shamash binary.

Install

pip install shamash-openclaw

One-command setup

shamash-openclaw-setup

This command:

1. Verifies ~/.openclaw/ exists.
2. Copies plugin assets into ~/.openclaw/plugins/shamash-openclaw/.
3. Installs a bundled platform-appropriate shamash binary into bin/shamash.
4. Registers plugin load path in ~/.openclaw/openclaw.json.

Recommended config hardening

Set explicit plugin/tool restrictions in ~/.openclaw/openclaw.json:

{
  "plugins": {
    "allow": ["shamash-openclaw"]
  },
  "tools": {
    "deny": ["web_fetch"]
  }
}

Why both settings are required:

• plugins.allow prevents rogue plugins from loading and registering competing hooks.
• tools.deny: ["web_fetch"] forces web retrieval through shamash_fetch, so Gate 2 scanning cannot be bypassed by direct web_fetch use.

Verify

After restarting OpenClaw:

• Run /shamash in chat and confirm plugin status appears.
• Check logs for Shamash 4-gate firewall active.

Notes

• Bundled binaries are currently shipped for darwin/linux x64+arm64; unsupported platforms require manual binaryPath override.
• If bundled binary install fails, set plugins.config.shamash-openclaw.binaryPath manually.
• For detailed plugin configuration, see integrations/openclaw/README.md.