shamash-openclaw 0.4.2

Shamash 4-gate security firewall for OpenClaw — one-command setup for prompt injection, jailbreak, and data exfiltration detection

shamash-openclaw (pip)

Python package wrapper that installs the OpenClaw Shamash plugin and a bundled platform-compatible Shamash binary.

Install

pip install shamash-openclaw

Upgrade

pip install --upgrade shamash-openclaw
shamash-openclaw-setup

After upgrading, re-run shamash-openclaw-setup to update the plugin files and binary in ~/.openclaw/plugins/shamash-openclaw/. Then restart OpenClaw.

One-command setup

shamash-openclaw-setup

This command:

1. Verifies ~/.openclaw/ exists.
2. Copies plugin assets into ~/.openclaw/plugins/shamash-openclaw/.
3. Installs a bundled platform-appropriate shamash binary into bin/shamash.
4. Registers plugin load path in ~/.openclaw/openclaw.json.

Recommended config hardening

Set explicit plugin/tool restrictions in ~/.openclaw/openclaw.json:

{
  "plugins": {
    "allow": ["shamash-openclaw"]
  },
  "tools": {
    "deny": ["web_fetch"]
  }
}

Why both settings are required:

• plugins.allow prevents rogue plugins from loading and registering competing hooks.
• tools.deny: ["web_fetch"] forces web retrieval through shamash_fetch, so Gate 2 scanning cannot be bypassed by direct web_fetch use.

Verify

After restarting OpenClaw:

• Run /shamash in chat and confirm plugin status appears.
• Check logs for Shamash 4-gate firewall active.

Changelog

• 0.4.2 — Documentation update (upgrade instructions, changelog)
• 0.4.1 — Fix Gate 1 blocking on Telegram (restore modelOverride mechanism), fix multi-line message extraction
• 0.4.0 — Pattern chapter release (3,316 patterns, 57.7% detection, 3.38% FP)
• 0.3.3 — Multi-channel envelope extraction
• 0.3.0 — 4-gate architecture with configurable thresholds and telemetry

Notes

• Bundled binaries are currently shipped for darwin/linux x64+arm64; unsupported platforms require manual binaryPath override.
• If bundled binary install fails, set plugins.config.shamash-openclaw.binaryPath manually.
• For detailed plugin configuration, see integrations/openclaw/README.md.