Tool-augmented LLM agents introduce security risks that extend beyond user-input filtering, including indirect prompt injection through fetched content, unsafe tool execution, credential leakage, and tampering with local control files. We present OpenClaw PRISM, a zero-fork runtime security layer for OpenClaw-based agent gateways. PRISM combines an in-process plugin with optional sidecar services and distributes enforcement across ten lifecycle hooks spanning message ingress, prompt construction, tool execution, tool-result persistence, outbound messaging, sub-agent spawning, and gateway startup. Rather than introducing a novel detection model, PRISM integrates a hybrid heuristic-plus-LLM scanning pipeline, conversation- and session-scoped risk accumulation with TTL-based decay, policy-enforced controls over tools, paths, private networks, domain tiers, and outbound secret patterns, and a tamper-evident audit and operations plane with integrity verification and hot-reloadable policy management. We outline an evaluation methodology and benchmark pipeline for measuring security effectiveness, false positives, layer contribution, runtime overhead, and operational recoverability in an agent-runtime setting, and we report current preliminary benchmark results on curated same-slice experiments and operational microbenchmarks. The system targets deployable runtime defense for real agent gateways rather than benchmark-only detection.

翻译：工具增强型大型语言模型（LLM）代理引入了超出用户输入过滤范畴的安全风险，包括通过获取内容进行的间接提示注入、不安全的工具执行、凭证泄漏以及对本地控制文件的篡改。本文提出OpenClaw PRISM，一种用于基于OpenClaw的代理网关的零分支运行时安全层。PRISM将一个进程内插件与可选的边车服务相结合，并将安全策略的执行分布在跨越消息入口、提示构建、工具执行、工具结果持久化、出站消息传递、子代理生成以及网关启动的十个生命周期钩子上。PRISM并非引入一种新颖的检测模型，而是集成了混合启发式加LLM扫描流水线、具有基于TTL衰减的会话与会话范围风险累积、对工具、路径、私有网络、域名层级和出站密钥模式进行策略强制控制，以及一个具备完整性验证和可热重载策略管理的防篡改审计与运维平面。我们概述了一种评估方法论和基准测试流水线，用于在代理运行时环境中测量安全有效性、误报率、各层贡献、运行时开销和操作可恢复性，并报告了当前在精选同切片实验和操作微基准测试上的初步基准结果。该系统旨在为真实的代理网关提供可部署的运行时防御，而非仅限于基准测试的检测。