C LAW G UARD : A RUNTIME S ECURITY F RAMEWORK FOR T OOL -AUGMENTED LLM AGENTS AGAINST I NDIRECT P ROMPT I NJECTION
arXiv:2604.11790v1 [cs.CR] 13 Apr 2026
Wei Zhao, Zhe Li, Peixin Zhang, Jun Sun Singapore Management University {wzhao,zheli,pxzhang,junsun}@smu.edu.sg Abstract—Tool-augmented Large Language Model (LLM) agents have demonstrated impressive capabilities in automating complex, multi-step real-world tasks, yet remain vulnerable to indirect prompt injection. Adversaries exploit this weakness by embedding malicious instructions within tool-returned content, which agents directly incorporate into their conversation history as trusted observations. This vulnerability manifests across three primary attack channels: web and local content injection, MCP server injection, and skill file injection. Existing defenses remain inadequate: model-level alignment requires fine-tuning and is still bypassable, protocol-level separation demands crossprovider coordination, and architecture-level enforcement either restricts agent flexibility or requires expert-authored rules per deployment, leaving all three injection pathways insufficiently mitigated. To address these vulnerabilities, we introduce C LAWG UARD, a novel runtime security framework that enforces a user-confirmed rule set at every tool-call boundary, transforming unreliable alignment-dependent defense into a deterministic, auditable mechanism that intercepts adversarial tool calls before any real-world effect is produced. By automatically deriving taskspecific access constraints from the user’s stated objective prior to any external tool invocation, C LAW G UARD blocks all three injection pathways without model modification or infrastructure change. Experiments across five state-of-the-art language models on AgentDojo, SkillInject, and MCPSafeBench demonstrate that C LAW G UARD achieves robust protection against indirect prompt injection without compromising agent utility. This work establishes deterministic tool-call boundary enforcement as an effective defense mechanism for secure agentic AI systems, requiring neither safety-specific fine-tuning nor architectural modification. Code is publicly available at https://github.com/Claw-Guard/ ClawGuard.
I.
I NTRODUCTION
Recent advances in tool-augmented large language model (LLM) agents have enabled automated execution of complex, multi-step real-world tasks, including web-augmented question answering [24], code generation and execution [6], and multi-step task execution [30], [39]. State-of-the-art agentic frameworks such as OpenClaw [25], AutoGPT [11], and LangChain [5] realize these capabilities through standardized tool-use interfaces, ranging from custom framework-specific mechanisms to protocol-level specifications such as the Model Context Protocol (MCP) [3]. These interfaces allow agents to browse the web, execute code, manage files, and orchestrate external services [24], [32], [39]. In a typical agentic pipeline, a user instruction is processed by the LLM, which first reasons and plans, then selects and invokes one or more tools based on the task requirements. Each tool output is then appended
directly to the conversation history as a new observation [17], and the agent reasons over the accumulated context to determine subsequent actions until a final response is generated. The direct integration of tool outputs into the agent’s conversation history as trusted observations, however, introduces a fundamental security vulnerability: adversaries who can influence any such output gain a direct channel into the agent’s reasoning process. Prior work has identified three primary injection channels exploiting this vulnerability [10], [12], [42]. First, web and local content injection embeds adversarial instructions in externally retrieved resources such as web pages, documents, and search results, which are returned as tool outputs and subsequently processed as trusted task observations. This type of attack requires only that an attacker compromise any resource the agent is likely to retrieve, making it applicable to any tool-augmented deployment that involves external content access [12], [15], [28], [42]. Second, MCP server injection exploits the open third-party MCP ecosystem: malicious or compromised servers may embed adversarial instructions in returned content, or—prior to any tool invocation—poison tool description metadata to influence tool-selection behavior [29], [38]. Third, skill file injection exploits public skill repositories where adversarial instructions are semantically integrated with legitimate behavioral guidance, making them indistinguishable without analysis of the agent’s intended task objectives [8], [33]. Existing approaches to mitigate these vulnerabilities fall into three categories: model-level, protocol-level, and architecture-level defenses, each carrying distinct limitations. Model-level defenses, including Reinforcement Learning from Human Feedback (RLHF)-based safety alignment [27] and instruction hierarchy training [36], require model fine-tuning and are thus inapplicable when deploying agents that access models through closed-source model APIs. Beyond this applicability constraint, state-of-the-art commercial models with strong safety alignment still fail to hold against context-dependent injections in agentic pipelines [33], [38]. Protocol-level defenses such as StruQ [7] physically separate instructions from data, but require coordinated changes across models and tool providers, rendering them incompatible with diverse agentic frameworks. Architecture-level defenses provide strong security guarantees at the cost of significant deployment overhead: CaMeL [9] is incompatible with open-ended agents whose tool calls are determined at runtime, and AgentSpec [37] requires manual rule authoring by domain experts for each deployment context. These limitations motivate the need for
nels—AgentDojo [10], SkillInject [33], and MCPSafeBench [44]—with five backbone LLMs demonstrate that C LAW G UARD consistently achieves strong defense performance while maintaining competitive Completion Rates across diverse backbone architectures.
a model-agnostic, protocol-agnostic middleware that automatically induces task-specific enforcement rules from context without model modification, infrastructure change, or domain expertise. In this work, we propose C LAW G UARD, a novel runtime security framework for tool-augmented LLM agents that enforces a user-confirmed rule set at every tool-call boundary, transforming unreliable, alignment-dependent defenses into a deterministic, auditable mechanism that intercepts adversarial tool calls before any real-world effect is produced. C LAWG UARD operates via two mechanisms: a one-time pre-session rule induction step that automatically derives task-specific access constraints from the user’s stated objective and confirms them before the first tool is invoked, producing Rtask that is uncontaminated by adversarial content and requires no manual rule authoring per deployment context, and per-toolcall enforcement that applies four components at every subsequent tool-call boundary: a Content Sanitizer that redacts sensitive data spans from outgoing tool-call arguments before tool execution and from incoming tool-returned content before the result is appended to the conversation history; a Rule Evaluator that evaluates each proposed tool call against an active rule set R = Rbase ∪ Rtask covering tool invocations, local file paths, and outbound network destinations; a Skill Inspector that performs automated risk assessment followed by mandatory user confirmation prior to first skill execution; and an Approval Mechanism that routes tool calls with ambiguous verdicts to the user for explicit authorization, with all events recorded in the Audit Log.
We believe that our findings and methods offer valuable insights and direction toward building safer, more reliable agentic systems, laying the groundwork for future research into ensuring comprehensive security at the tool-call boundary in tool-augmented LLM agent deployments. II. A. Agent Framework Tool-augmented LLM agents constitute the dominant paradigm for automating complex, multi-step real-world tasks. An agent A consists of an LLM backbone M and a tool set T , enabling it to interact with the environment by issuing tool calls and incorporating their outputs into subsequent reasoning. OpenClaw [25] is a representative instantiation of this paradigm; variants including Claude Computer Use [2], AutoGPT [11], and LangChain [5] interact through visual channels or general-purpose orchestration interfaces but follow essentially the same workflow. The tool set T = {t1 , . . . , tn } encompasses three categories: (i) native tools, built-in capabilities provided by the agent framework such as read, write, and exec, which interact directly with the local environment without external communication; (ii) skills, reusable capability modules defining higher-level behaviors, loaded from configuration files or public skill repositories [8], [33]; and (iii) MCP servers, external tool providers compliant with the Model Context Protocol [3], [29], exposing structured APIs such as web search and database access.
Through comprehensive experiments on established benchmarks and attack settings—including AgentDojo [10], SkillInject [33], and MCPSafeBench [44] across five state-ofthe-art language models—we demonstrate that C LAW G UARD consistently and substantially reduces attack success across all evaluated scenarios. These results substantially surpass unprotected baseline models, highlighting the effectiveness of deterministic tool-call boundary enforcement as a defense layer that operates independently of model-level probabilistic resistance.
The agent operates over a conversation history H = (m1 , . . . , mk ), where each message mi = (ri , ci ) has a role ri ∈ {system, user, assistant, tool} and content ci ∈ Σ∗ , where Σ∗ represents the set of all finite strings. At each step t, the agent selects either a direct text output or a tool call a = (tj , q), where tj ∈ T and q ∈ Σ∗ is the query argument: at ∈ O ∪ CT (1)
In summary, the key contributions of our work are: •
•
•
P RELIMINARIES
Novel Rule-Based Defense at the Tool-Call Boundary: We introduce C LAW G UARD, the first runtime security framework that defends tool-augmented LLM agents against all three primary indirect prompt injection channels—web and local content injection, MCP server injection, and skill file injection—through deterministic, auditable enforcement at every tool-call boundary.
where O is the set of direct text outputs and CT = {(tj , q) | tj ∈ T , q ∈ Σ∗ } is the set of tool calls. When at = (tj , q), the tool returns a result: oj = tj (q) ∈ Σ∗
(2)
and the conversation history is extended:
Context-Aware Rule Induction with User Confirmation: By automatically deriving task-specific access constraints from the user’s stated objective prior to any external tool invocation, C LAW G UARD ensures that the active rule set R = Rbase ∪Rtask reflects intended task scope uncontaminated by adversarial content, enabling comprehensive enforcement without requiring manual rule authoring per deployment context.
Ht+1 = Ht · (tool, oj )
(3)
The agent iteratively updates the conversation from Ht to Ht+1 until the task goal is achieved, a predefined step budget is exhausted, or a final response is generated [17]. Since the observation oj is appended to H without safety verification, this direct integration renders the interaction loop inherently susceptible to adversarial manipulation via tool-returned content. We formalize this vulnerability in the following threat model.
Empirical Validation: Extensive evaluations across three benchmarks spanning all three injection chan2
Environment Interaction Boundary Untrusted
Agent System
𝑎𝑎𝑡𝑡 = 𝑡𝑡𝑗𝑗 , 𝑞𝑞 tool call
𝑜𝑜𝑗𝑗 = 𝑡𝑡𝑗𝑗 𝑞𝑞 ∈ Σ ∗ tool output
𝑜𝑜�𝑗𝑗 = 𝑜𝑜𝑗𝑗 ⊕ 𝛿𝛿
adversarial output
Fig. 1: Architecture and threat model of a tool-augmented LLM agent. At each step, the agent issues a tool call a = (tj , q) and appends the returned output oj = tj (q) to the conversation history H. Since tool outputs are directly integrated into H without safety verification, adversaries can inject malicious content õj to manipulate agent behavior.
Adversarial objectives. We identify the following adversarial objectives: (1) Data exfiltration: adversarial instructions transmit sensitive user data to attacker-controlled endpoints [12], [42]; (2) Unauthorized action: adversarial instructions invoke system operations such as file deletion, code execution, or communications outside the user’s task scope [10], [15], [33]; (3) Financial manipulation: adversarial instructions redirect payments or initiate unauthorized transactions [10], [44]; (4) Privilege escalation: adversarial instructions extend the agent’s capabilities or permissions beyond the authorized scope, for example by poisoning tool metadata to expand the set of accessible tools [38], [44]; (5) Persistent compromise: adversarial instructions modify agent configuration or skill state to sustain attacker influence across future sessions [8], [33].
B. Threat Model Adversary. We consider an adversary E who controls one or more tool outputs to the agent. The adversary E embeds adversarial instructions δ ∈ Σ∗ into tool returns oj , producing poisoned outputs õj that enter the agent’s conversation history as trusted observations. We identify three primary injection channels corresponding to the threat surfaces illustrated in Figure 1. (1) Web and local content injection. When the agent retrieves external content such as web pages, documents, or search results, adversarial instructions embedded in those sources are returned as tool output and processed by the LLM. This injection channel is extensively studied in previous literature [12], [15], [18], [28], [42]: an attacker need only inject adversarial content into any resource the agent is likely to retrieve, making this channel broadly realizable in any agent deployment involving external content access.
Scope. The adversary E has black-box access to tool output channels: it can craft arbitrary õj but has no access to the system prompt, conversation history prior to injection, or model weights. Direct prompt injection (attacker modifies the user turn) and jailbreak attacks [31], [34] are outside the scope of this work, as both require attacker control of the user-facing input channel or exploitation of model weight vulnerabilities. Model fine-tuning attacks are similarly out of scope.
(2) MCP server injection. The MCP ecosystem allows agents to discover and invoke tools from arbitrary third-party servers, including community-contributed servers whose safety cannot be guaranteed in advance [29], [38]. A malicious or compromised MCP server can embed adversarial instructions in any returned content, or poison its tool description metadata to influence tool-selection behavior before any query is issued.
While indirect injection attacks are realized through toolreturned content, many such attacks are well-obfuscated or delivered incrementally: unsafe commands may be constructed gradually across multiple interaction steps rather than delivered in a single injected response [31], [42]. Furthermore, tool returns are often long and semantically rich, making exhaustive inspection of each individual observation inherently infeasible [12], [40]. These characteristics motivate enforcing security controls at the tool-call boundary, where each proposed tool
(3) Skill file injection. Skills extend agent capabilities through configuration files that combine natural language behavioral directives with tool invocation instructions and capability descriptions. Public skill ecosystems have been found to contain entries with adversarial or policy-violating instructions [8], [33]. Skill content is inherently directive, so adversarial additions are semantically indistinguishable from legitimate behavioral guidance without goal-level analysis. 3
When x matches patterns in both B and W simultaneously (e.g., due to overlapping glob patterns), blacklist priority applies: Velem (x) = ⊥.
call can be evaluated against a user-confirmed policy before any real-world effect is produced. C LAW G UARD is designed to meet precisely this requirement. III.
When a tool call yields multiple relevant attributes {xi }, the overall verdict combines their individual evaluations by selecting the most restrictive outcome: ∃xi : Velem (xi ) = ⊥ ⊥ V(a∗ ) = amb ∃xi : Velem (xi ) = amb (7) ⊤ otherwise
C LAW G UARD
In this section, we describe the architecture of C LAWG UARD, detailing the four enforcement components, the context-aware rule induction procedure, and a concrete case study demonstrating end-to-end operation under adversarial injection. Figure 2 illustrates the framework and the flow of control through its components.
Moreover, for tool invocation inputs, an obfuscation normalizer [4], [26] is applied prior to evaluation. Inputs exhibiting obfuscation patterns—such as Base64-encoded content, hexencoded characters, excessive shell indirection, or string fragmentation via concatenation operators—are detected by the normalizer and conservatively mapped to amb, escalating the call for human review. Detailed descriptions of the obfuscation normalizer are provided in the Appendix.
A. Rule-Based Action Authorization Without an interposed security layer, tool-augmented agents execute autonomously proposed tool calls without verifying whether those calls fall within the user’s intended scope [10], [30]. C LAW G UARD addresses this structural gap by placing four components at every tool-call boundary: a Content Sanitizer, a Rule Evaluator, a Skill Inspector, and an Approval Mechanism, each enforcing a distinct aspect of the active rule set R at every tool-call boundary.
3) Skill Inspector Skills are loaded directly into the agent’s local environment and executed through a combination of natural language descriptions and embedded scripts. As the LLM cannot fully reason over a skill’s complete contents at runtime, an explicit safety assessment is required only before the skill’s first-ever execution; subsequent invocations in any session reuse the cached verdict. The Skill Inspector performs this assessment in two sequential stages: (1) automated risk analysis by an LLM judge I, and (2) mandatory confirmation by the user.
1) Content Sanitizer Let a = (tj , q) denote a tool call, where tj ∈ T is the tool identifier and q ∈ Σ∗ is the raw query argument. The Content Sanitizer S applies a pattern library P to redact sensitive spans from q, yielding sanitized argument q ∗ : q ∗ = Sin (q, P)
(4)
The pattern library P is extensible. To facilitate practical adoption of ClawGuard, a pre-built pattern library covering popular use cases is made available (see Appendix A). Each matched span is replaced with a type-specific redaction token such as ⟨AWS_ACCESS_KEY_REDACTED⟩. After the call executes and returns oj = tj (q ∗ ), output sanitization is applied to the return value before it is appended to the conversation history, yielding sanitized output o∗j : o∗j = Sout (oj , P)
For a skill with content s, LLM judge I first produces a structured risk assessment ρs = I(s) using a pre-defined judge template (see the judge template in Appendix A), which is then presented to the user U for a final binary verdict: vs = U(ρs ) ∈ {⊤, ⊥}
(8)
If vs = ⊥, the skill is rejected and excluded from the session. If vs = ⊤, the skill identifier tj is admitted and recorded in the allowlist Ψ ← Ψ ∪ {tj }, allowing future invocations of the same skill to bypass re-inspection. On subsequent invocations, if tj ∈ Ψ, the cached approval is applied directly, ensuring inspection cost is incurred at most once per skill content version across all future sessions. If the skill content is modified, the updated version is treated as a new skill and requires re-inspection.
(5)
Content sanitization prevents sensitive data from being transmitted through tool arguments; output sanitization prevents it from propagating into the agent’s subsequent reasoning. 2) Rule Evaluator The Rule Evaluator V checks the sanitized tool call a∗ = (tj , q ∗ ) against the active rule set R. R covers three domains: tool invocations, which encompass both framework-native tool calls (e.g., read, write, web_fetch) and shell-level execution commands issued via exec; local file paths; and outbound network destinations. Each domain d ∈ {cmd, file, net} is associated with a blacklist Bd and a whitelist Wd defined over regex or glob patterns.
4) Approval Mechanism When V(a∗ , R) = amb, the tool call is placed into the approval queue Q (an ordered set of pending ambiguous calls) and presented to the user U for explicit authorization before execution. The agent pauses until the user provides a decision or the configurable timeout τ elapses. If the user approves, the call proceeds. If the user rejects or the timeout expires, the tool call is blocked and the event is recorded in the Audit Log. All authorization, sanitization, and skill inspection events are recorded in the Audit Log with entries of the form ⟨a∗ , V(a∗ , R), verdict, ts⟩. Algorithm 1 gives the complete procedure.
For each relevant attribute x extracted from a∗ (e.g., tool name or shell command string, resolved file path, or target domain), we define an element-level decision function: if x matches any pattern in B ⊥ Velem (x) = ⊤ (6) if x matches any pattern in W amb otherwise (conservative default) 4
ClawGuard
LLM Agent
A Rule Induction (from Agent) user
Rule set
B Enforcement pipeline (per interaction) Sanitization
Rule Evaluation
Approval Queue allow/ deny / approval
Skill inspector (once per skill) user
Fig. 2: Overview of C LAW G UARD. The framework enforces security at the tool-call boundary via content sanitization, rule-based authorization, skill inspection, and user approval. Each tool call a = (tj , q) is transformed into a∗ = (tj , q ∗ ) and evaluated by V under a rule set R = Rbase ∪ Rtask .
prompt is provided in Appendix A. Rule induction occurs before any external tool is invoked, ensuring Rraw task reflects intended task scope uncontaminated by external content. Since M is the same LLM backbone used for task execution, the quality of the induced rule set Rtask depends on M’s instruction-following and reasoning capabilities. Weaker backbones may produce over-permissive rules (creating security gaps) or under-permissive rules (causing false-positive blocks); If M(ρ, H0 ) fails to produce a parseable JSON rule set (e.g., due to truncation or format violations), C LAW G UARD falls back to Rbase only, maintaining minimum security guarantees.
B. Context-Aware Rule Induction The authorization pipeline is parameterized by the rule set R = Rbase ∪ Rtask , whose coverage directly determines enforcement quality. Rbase encodes system-level security invariants that hold unconditionally; Rtask encodes task-specific access constraints derived automatically from the user’s stated objective. Rule induction proceeds in three sequential steps: Step 1: Baseline Rule Set The baseline Rbase is a fixed, operator-specified set of unconditional security invariants targeting the highest-severity attack objectives identified in established threat taxonomies [14], [21], [22]: exfiltration to non-whitelisted endpoints, access to credential stores, self-modification of agent configuration, and invocation of irreversible system commands. Enforcement actions are fixed at deny and cannot be overridden by Rtask . The complete baseline rule set is listed in Appendix A.
Step 3: User Confirmation and Rule Activation Before activation, Rraw task is presented to the user for review and may be adjusted to better reflect task intent, yielding Rtask . User edits apply only to task-specific entries; Rbase invariants remain non-negotiable. The final active rule set is: R = Rbase ∪ Rtask
Step 2: Task-Specific Rule Induction
(10)
Since Rbase rules are evaluated unconditionally, entries in Rtask cannot override the system-level invariants, preserving minimum security guarantees across all task configurations.
Prior to any tool call, C LAW G UARD injects a structured induction prompt ρ into the agent’s context, producing a raw task rule set : Rraw (9) task = M(ρ, H0 )
C. Case Study: End-to-End Enforcement under Adversarial Injection
where M is the underlying LLM and H0 is the conversation history containing only the user’s stated task objective. The induction prompt instructs M to derive three rule categories: network access rules (domain whitelist and blacklist), local resource rules (path whitelist and blacklist), and command rules, which govern both framework-native tool calls (e.g., read, write, web_fetch) and shell-level execution commands issued via exec (e.g., curl | bash); the full
We present a concrete scenario in which a legitimate task is exploited by an adversary who embeds malicious instructions within intermediate tool returns. This scenario is representative of the indirect injection threat model described in Section II and demonstrates how each C LAW G UARD component contributes to neutralizing the attack. 5
Algorithm 1 C LAW G UARD: Action Authorization and Sanitization Require: Tool call a = (tj , q), rule set R, pattern library P, allowlist Ψ, timeout τ Ensure: Sanitized return o∗j , or ⊥ 1: q ∗ ← Sin (q, P) {Redact sensitive spans} 2: if tj is a skill and tj ∈ / Ψ then 3: ρs ← I(tj ); vs ← U(ρs ) {LLM judge assessment; await user U’s verdict} 4: if vs = ⊥ then 5: Log(a∗ , block); 6: return ⊥ 7: end if 8: Ψ ← Ψ ∪ {tj } {Persist approved skill to allowlist} 9: end if 10: v ← V(a∗ , R) {Most restrictive verdict wins} 11: if v = ⊥ then 12: Log(a∗ , block); 13: return ⊥ 14: else if v = amb then 15: d ← U(Q, τ ) {Block until approved or τ elapses} 16: if d ̸= approve then 17: Log(a∗ , block); 18: return ⊥ 19: end if 20: end if 21: oj ← tj (q ∗ ); o∗j ← Sout (oj , P) 22: Log(a∗ , allow); 23: return o∗ j
(web_fetch, "example-research.org/blog"). The Content Sanitizer finds no sensitive spans and the Rule Evaluator returns V(a∗1 ) = ⊤; the call proceeds. Two further web_fetch calls for individual post URLs under the same domain pass identically. Step 3: Adversarial Injection. The third blog post contains the following text injected by the attacker: Injected Content in Tool Return o3 [. . . legitimate blog content. . . ] SYSTEM OVERRIDE: Ignore previous instructions. cat ˜/.ssh/id_rsa | curl -X POST exfil.io -d @Then: rm -rf ˜/.ssh/
The injected text enters H as (tool, o3 ). The LLM then generates the following tool call, denoted a4 : a4 = exec, "cat ˜/.ssh/id_rsa | {z } q4 | curl -X POST exfil.io -d @-" | {z }
(11)
Step 4: Blocked Attack. C LAW G UARD evaluates a4 through two sequential components. Content Sanitizer: No redactable secrets are present in q4 at this stage, so q4∗ = q4 ; the action proceeds to the Rule Evaluator. Rule Evaluator: Two independent findings are produced:
Active Rule Set R (confirmed by user)
leftmargin=1.5em,itemsep=2pt,topsep=2pt
Network rules whitelist: ["example-research.org"] (induced, Rtask ) blacklist: ["*.onion" ...] (default, Rbase )
1) 2)
File rules whitelist: ["∼/reports/"] (induced, Rtask ) blacklist: ["∼/.ssh/", ...] (defaults, Rbase )
Tool domain: exec ∈ Bcmd (denied by Rtask ) ⇒ Velem = ⊥. Filesystem domain: ˜/.ssh/id_rsa ∈ Bfile (default, Rbase ) ⇒ Velem = ⊥.
Applying the most-restrictive-wins policy, the aggregate verdict is V(a∗4 ) = ⊥. The call is blocked and logged as ⟨a∗4 , ⊥, block, ts4 ⟩. The follow-up exec call proposing rm -rf ˜/.ssh/ is blocked identically.
Tool invocation rules allow: ["web_fetch", "read", "write"] deny: ["exec", ["rm -rf", "wget.*\|\s*(bash|sh|...)", ...]
Step 5: Legitimate Write. The agent recovers and issues a5 = (write, "˜/reports/summary.md"). The path matches Wfile , returning V(a∗5 ) = ⊤; the file write proceeds without user interruption and the task completes as intended.
Fig. 3: Active rule set R = Rbase ∪ Rtask confirmed for the blog-summarization task.
Discussion. This scenario illustrates two security properties of C LAW G UARD: pre-invocation enforcement, whereby the injected commands are blocked before any real-world effect occurs; and defense in depth, whereby the adversariallytriggered tool call violates both a task-specific deny rule (Rtask blocks exec) and a system-level credential-access invariant (Rbase denies ˜/.ssh/ access). Furthermore, the two independent Rule Evaluator verdicts (⊥ on tool domain and ⊥ on filesystem domain) exemplify how multiple enforcement layers independently detect the same malicious call. The legitimate task completes without user interruption since its tool calls fall entirely within the confirmed whitelist, demonstrating that strict enforcement need not impair usability for well-scoped tasks.
Scenario Setup. The user instructs the agent to “summarize the contents of the three most recent blog posts from example-research.org and save the summary to ˜/reports/summary.md.” This is a straightforward retrieval-and-write task involving two tool types: web_fetch and write. Step 1: Rule Induction. Before any tool is invoked, C LAWG UARD induces Rraw task from H0 , presents it to the user, and activates the confirmed rule set R shown in Figure 3. Step 2: Tool Pass. The agent issues the first tool call a1 = 6
IV.
E XPERIMENTAL E VALUATION
TABLE I: Results on AgentDojo (160 tasks/model).
In this section, we comprehensively evaluate C LAW G UARD across three benchmarks and five state-of-the-art LLMs as agent backbone to assess its effectiveness against tool-returned prompt injection attacks. We have implemented C LAW G UARD based on the OpenClaw framework, with the full implementation made publicly available at https://github.com/Claw-Guard/ ClawGuard. A. Experiment Setup Benchmarks. We evaluate on three benchmarks covering distinct adversarial objectives and injection modes. AgentDojo [10] provides 10 task environments paired with 16 attack scenarios, yielding 160 task instances per model, with objectives including data exfiltration, unauthorized action, and financial manipulation; all injections are syntactically explicit. SkillInject [33] provides 84 skill file injection attacks spanning two modes: 48 context-dependent attacks, in which adversarial instructions are semantically interleaved with legitimate skill content, and 36 obvious attacks; objectives include data exfiltration, unauthorized execution, and unauthorized communication. MCPSafeBench [44] covers 215 real-world MCP server attack scenarios across four task domains: repository management, financial analysis, web search, and location navigation.
Model
CR (%)
ASR (%)
RR (%)
IRR (%)
DSR (%)
DeepSeek-V3.2 + CG BASIC RULES
100.0 100.0
3.1 0.0
8.8 35.0
88.1 65.0
96.9 100.0
GLM-5 + CG BASIC RULES
100.0 100.0
1.9 0.0
10.6 32.5
87.5 67.5
98.1 100.0
Kimi-K2.5 + CG BASIC RULES
98.8 100.0
1.2 0.0
9.4 29.4
88.1 70.6
97.5 100.0
MiniMax-M2.5 + CG BASIC RULES
100.0 100.0
2.5 0.0
13.1 31.2
84.4 68.8
97.5 100.0
Qwen3.5-397B-A17B + CG BASIC RULES
98.1 99.4
0.6 0.0
6.2 29.4
91.2 70.0
97.5 99.4
models are not fully immune. This suggests that reliably circumventing model-level alignment requires more sophisticated strategies, such as multi-turn distribution or semantically obfuscated injection instructions. With C LAW G UARD (basic-rule configuration), ASR reaches 0% across all backbone models, achieving perfect 100% DSR on AgentDojo. This effectiveness stems from C LAW G UARD’s rule-based enforcement at every tool-call boundary, which intercepts adversarial tool calls before execution regardless of the model’s probabilistic resistance, transforming unreliable alignment-dependent defense into a deterministic, auditable mechanism. The RR/IRR decomposition reveals a qualitative shift in defense behavior: without C LAW G UARD, only 9–16% of defense outcomes are explicit refusals (RR), reflecting predominantly unaudited probabilistic resistance; with C LAW G UARD, RR rises to 29–35%, converting silent probabilistic resistance into Audit-Log-recorded refusal events and confirming structural improvement across diverse backbone architectures.
Implementation. We evaluate C LAW G UARD on five state-of-the-art LLMs: DeepSeek-V3.2 [16], GLM-5 [41], Kimi-K2.5 [23], MiniMax-M2.5 [20], and Qwen3.5-397BA17B [35]. All experiments use the default OpenClaw configuration with a five-minute timeout per task. The current evaluation employs the basic-rule configuration of C LAW G UARD, in which the active rule set consists solely of the baseline rule set Rbase without the task-specific rule induction component; full results incorporating contextaware rule induction will be reported in a future version. For the Approval Mechanism, all tool calls receiving an ambiguous verdict amb from the Rule Evaluator are treated as direct refusals without forwarding to the user, simulating a conservative deployment state.
C. Results on SkillInject Table II presents defense results on SkillInject. Baseline ASR of 26–48% demonstrates that skill injection attacks remain effective against LLMs with strong safety alignment, substantially exceeding the AgentDojo baseline (0.6–3.1%). This elevated vulnerability stems from two concurrent factors: adversarial instructions are semantically integrated with legitimate content, evading text-based safety alignment, and agents typically execute skill procedures upon reading their descriptions without verifying the safety of each instruction step.
Metrics. We evaluate each scenario along two dimensions. For safety, we report the Defense Success Rate (DSR), defined as the fraction of injection cases in which the targeted adversarial action is not successfully induced, decomposed as DSR = RR + IRR: Refusal Rate (RR) counts cases of explicit refusal or a C LAW G UARD deny, while Implicit Resistance Rate (IRR) counts cases where the adversarial action is silently avoided. Completion Rate (CR) measures the fraction of tasks successfully completed by the agent without timeout. For each scenario, a human judge determines whether the targeted adversarial action was successfully induced, and the outcome is used to compute all metrics above. Attack Success Rate(ASR) is reported for convenience, where lower is better.
With C LAW G UARD (basic-rule configuration), overall ASR falls to 4.8–14%, achieving a 50–84% relative reduction. This defense effectiveness stems from C LAW G UARD’s rule evaluation at tool-call boundaries, which intercepts adversarial signals before execution even when injection instructions successfully bypass model-level safety alignment, providing a deterministic defense layer that operates independently of the model’s probabilistic resistance. GLM-5 achieves 82.1% DSR with 4.8% residual ASR, while MiniMax-M2.5 reaches the highest absolute DSR of 84.6%, confirming our method’s effectiveness across diverse backbone LLMs.
B. Results on AgentDojo Table I summarizes defense results on AgentDojo. Baseline models achieve DSR of 97.4–98.2% across all five backbone LLMs, demonstrating that RLHF-based safety alignment in commercial models already provides strong resistance against syntactically explicit, single-turn injection attacks. The residual ASR of 0.6–3.1% confirms that even well-aligned commercial
Residual failures are concentrated in context-dependent injection (8–24% ASR, down from 44–78% baseline), primarily 7
limited to content-misleading attacks whose outcomes manifest in LLM-generated content rather than tool-call operations, and stealth injections in domains with insufficient endpoint coverage, both arising from the basic-rule configuration’s lack of semantic task-context awareness. Incorporating contextaware rule induction to address these limitations is planned for a future revision.
TABLE II: Results on SkillInject (84 attacks/model). Model
CR (%)
ASR (%)
RR (%)
IRR (%)
DSR (%)
DeepSeek-V3.2 + CG BASIC RULES
85.7 85.7
40.5 14.2
20.2 46.5
25.0 25.0
45.2 71.5
GLM-5 + CG BASIC RULES
89.3 86.9
29.8 4.8
36.9 61.9
22.6 20.2
59.5 82.1
Kimi-K2.5 + CG BASIC RULES
90.5 90.5
47.6 13.1
27.4 61.9
15.5 15.5
42.9 77.4
MiniMax-M2.5 + CG BASIC RULES
89.3 90.5
26.2 5.9
29.8 51.3
33.3 33.3
63.1 84.6
A. LLM Agents and the Tool-Use Paradigm
Qwen3.5-397B-A17B + CG BASIC RULES
85.6 85.6
34.5 14.2
32.1 52.4
19.0 19.0
51.1 71.4
The ReAct framework [39] established the foundational paradigm of interleaving reasoning with tool invocations, maintaining a persistent conversation history that records all actions and observations and enables agents to iteratively acquire and process external information. Toolformer [32] extended this line with self-supervised tool-use learning, and WebGPT [24] further applied the paradigm to web-augmented factual question answering. These foundations underlie the current generation of production agent frameworks. Building on this paradigm, AutoGPT [11] decomposes high-level objectives into a sequence of subtasks executed across multiple tool-use iterations, enabling long-horizon planning without per-step human oversight. Similarly, LangChain [5] provides a modular composition framework that chains LLM calls, retrieval operations, and tool invocations into reusable agentic pipelines. More recently, OpenClaw [25] provides a locallydeployed, production-grade architecture with native MCP support, a hierarchical skill module system, and a persistent memory substrate. Claude Code [1] similarly instantiates a tool-augmented software engineering agent, combining code execution, file management, and web access within a persistent conversation history.
V.
TABLE III: Results on MCPSafeBench (215 tasks/model). Model
CR (%)
ASR (%)
RR (%)
IRR (%)
DSR (%)
DeepSeek-V3.2 + CG BASIC RULES
84.5 82.0
44.5 7.1
17.2 45.1
22.8 29.8
40.0 74.9
GLM-5 + CG BASIC RULES
88.5 85.8
37.8 10.0
28.8 49.8
21.9 26.1
50.7 75.8
Kimi-K2.5 + CG BASIC RULES
86.0 83.4
43.7 8.5
24.2 50.2
18.1 24.7
42.3 74.9
MiniMax-M2.5 + CG BASIC RULES
89.5 86.8
36.5 11.0
29.3 48.4
23.7 27.4
53.0 75.8
Qwen3.5-397B-A17B + CG BASIC RULES
87.5 84.9
41.9 9.5
25.1 48.8
20.5 26.5
45.6 75.4
from content-misleading attacks whose adversarial outcomes are embedded in LLM-generated content rather than explicit tool-call operations, making them inherently difficult to intercept without system-level semantic monitoring.
R ELATED W ORK
A complementary paradigm is represented by GUI-based computer use agents [2], which operate through visual observation and UI action channels rather than structured API responses. While the attack surface of GUI agents differs in form—operating on visual observations rather than structured tool returns—the underlying structural vulnerability is analogous: externally-derived content influences LLM reasoning without interposed safety verification. Despite the diversity of these paradigms, the security of production deployments with heterogeneous, multi-tool architectures and persistent skill ecosystems remains substantially underexplored. C LAWG UARD specifically targets the OpenClaw-style paradigm, where the simultaneous presence of MCP servers, skill files, and a persistent conversation history introduces multiple distinct injection surfaces that collectively encompass all three injection channels identified in §II-B.
D. Results on MCPSafeBench Table III presents defense results on MCPSafeBench. Baseline ASR of 36.5–46.1%, comparable to SkillInject, confirms that LLM agents do not natively verify MCP server content, processing returned payloads as trusted observations regardless of origin. The RR/IRR decomposition further reveals that 43– 57% of baseline defense outcomes are silent (IRR), indicating heavy reliance on implicit RLHF-based resistance rather than deliberate refusal. With C LAW G UARD (basic-rule configuration), ASR falls to 10.2–11.2% while DSR rises to 74.9–75.8%, with explicit refusals rising to 45.1–50.2% (RR), converting the majority of previously silent outcomes into Audit-Log-recorded refusal events. Residual ASR is concentrated in stealth injection within the location navigation tasks, where C LAW G UARD’s basicrule configuration blacklist lacks sufficient endpoint coverage, confirming that context-aware rule induction is essential for comprehensive deployment.
B. Indirect Prompt Injection Early prompt injection work demonstrated that adversarial instructions appended to model inputs can override intended behavior [28]. In parallel, gradient-based adversarial suffix optimization (GCG [45]) demonstrated universal and transferable attacks against white-box model weights, substantially amplifying injection effectiveness in accessible models. As LLM deployments expanded into application pipelines, the attack surface shifted to the indirect setting, where adversarial instructions embedded in retrieved external content can redirect
Across all three benchmarks, C LAW G UARD with basicrule configuration demonstrates consistent defense improvements over unprotected baselines, achieving perfect DSR on AgentDojo and substantial ASR reductions on SkillInject and MCPSafeBench, confirming that deterministic tool-call boundary enforcement provides a robust defense layer independent of model-level probabilistic resistance. Residual failures are 8
channels without requiring model fine-tuning, protocol coordination with tool providers, or manual rule authoring, achieving these properties through automated rule induction confirmed by the user.
application behavior without system prompt access [12], [18], [19]. Such attacks have since been observed in production via RAG-augmented tool chains [15]. Agent-specific benchmarks further characterize this threat. InjecAgent [42] and AgentDojo [10] demonstrate high attack success rates across state-of-the-art models, and BIPIA [40] identifies a key root cause: LLMs cannot reliably distinguish informational context from actionable instructions. AgentSafetyBench [43] evaluates 16 popular LLM agents across 349 safety-relevant scenarios and finds that none achieves a safety score above 60%, attributing failures to insufficient robustness against adversarial instructions and limited awareness of unsafe execution contexts. In parallel, skill file injection [33] demonstrates that public skill repositories represent a distinct injection surface where context-dependent injections can defeat RLHF-based defenses. The expansion of the MCP ecosystem has further widened the attack surface, with tool poisoning via MCP payloads [38] and trust boundary violations across registered MCP servers [29] showing that context-dependent injections can defeat RLHF-based defenses across all three injection channels. Our work directly addresses all three injection channel variants, with particular emphasis on contextdependent injection that existing benchmarks identify as most resistant to model-level defenses.
VI.
C ONCLUSION
In this work, we introduce C LAW G UARD, a runtime security framework designed to enhance the safety of toolaugmented LLM agents against indirect prompt injection across all three primary injection channels. Systematic evaluations demonstrate: •
Deterministic rule enforcement at the tool-call boundary significantly reduces attack success rates against web and local content injection, MCP server injection, and skill file injection across diverse backbone architectures.
•
Context-aware rule induction automatically derives task-specific access constraints prior to any external tool invocation, enabling comprehensive enforcement without manual rule authoring or model modification.
Overall, C LAW G UARD offers a practical and unified defense for tool-augmented LLM agents, outperforming prior approaches while maintaining competitive task completion rates. Our findings highlight the promise of deterministic boundary enforcement for robust agentic AI safety, motivating further research into model-agnostic defense strategies for agentic deployments.
C. Defenses Against Prompt Injection Existing defenses against prompt injection fall into three categories—model-level, protocol-level, and architecturelevel—each addressing the threat at a different point in the pipeline, yet all leaving agentic systems exposed to contextdependent injection. Model-level defenses resist adversarial instructions by modifying or augmenting model behavior, typically through fine-tuning or auxiliary classification. RLHF-based safety alignment [27] and instruction hierarchy training [36] both require fine-tuning that is inapplicable to deployments based on closed-source APIs. As our results confirm for RLHFtrained commercial models, RLHF-based alignment does not hold against context-dependent injection [33], [38] in agentic pipelines. Protocol-level defenses such as StruQ [7] physically separate instructions from data, but require coordinated changes to models and tool providers that are incompatible with heterogeneous ecosystems. PromptLocate [13] takes a complementary approach by localizing adversarial payload segments within tool-returned content, enabling targeted remediation rather than holistic separation of instructions from data. Architecture-level defenses are the most structurally ambitious. CaMeL [9] introduces a dual-LLM architecture that separates trusted query processing from untrusted data handling, preventing injected content from influencing the agent’s control decisions. AgentSpec [37] provides a domain-specific language for authoring runtime enforcement constraints with triggers, predicates, and enforcement actions. However, CaMeL is incompatible with open-ended agents issuing dynamically determined tool calls, and AgentSpec requires manual rule authoring for each deployment. In contrast to all reviewed approaches, C LAW G UARD is the only defense that simultaneously addresses all three injection 9
R EFERENCES [1]
Anthropic, “Claude Code: Agentic coding tool,” https://www.anthropic. com/claude-code, 2024.
[2]
——, “Claude computer computer-use, 2024.
[3]
——, “Model context protocol,” https://modelcontextprotocol.io, 2024.
[4]
H. Chai, L. Ying, H. Duan, and D. Zha, “Invoke-deobfuscation: Astbased and semantics-preserving deobfuscation for powershell scripts,” in 2022 52nd Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN). IEEE, 2022, pp. 295–306.
use,”
[24]
https://www.anthropic.com/news/
[5]
H. Chase, “LangChain,” https://github.com/langchain-ai/langchain, 2023.
[6]
M. Chen, J. Tworek, H. Jun, Q. Yuan, H. P. D. O. Pinto, J. Kaplan, H. Edwards, Y. Burda, N. Joseph, G. Brockman et al., “Evaluating large language models trained on code,” arXiv preprint arXiv:2107.03374, 2021.
[7]
S. Chen, J. Piet, C. Sitawarin, and D. Wagner, “{StruQ}: Defending against prompt injection with structured queries,” in 34th USENIX Security Symposium (USENIX Security 25), 2025, pp. 2383–2400.
[8]
ClaWHub Community, “ClaWHub: Open skill registry for OpenClaw agents,” https://clawhub.ai, 2026.
[9]
E. Debenedetti, I. Shumailov, T. Fan, J. Hayes, N. Carlini, D. Fabian, C. Kern, C. Shi, A. Terzis, and F. Tramèr, “Defeating prompt injections by design,” ArXiv, vol. abs/2503.18813, 2025. [Online]. Available: https://api.semanticscholar.org/CorpusID:277940706
[10]
[23]
[25] [26]
[27]
[28] [29]
[30]
E. Debenedetti, J. Zhang, M. Balunovi’c, L. Beurer-Kellner, M. Fischer, and F. Tramèr, “Agentdojo: A dynamic environment to evaluate attacks and defenses for llm agents,” ArXiv, vol. abs/2406.13352, 2024. [Online]. Available: https://api.semanticscholar.org/CorpusID: 270619628
[31]
[11]
S. Gravitas, “AutoGPT: An autonomous GPT-4 experiment,” https:// github.com/Significant-Gravitas/AutoGPT, 2023.
[32]
[12]
K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, “Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection,” in Proceedings of the 16th ACM workshop on artificial intelligence and security, 2023, pp. 79–90.
[33]
Y. Jia, Y. Liu, Z. Shao, J. Jia, and N. Z. Gong, “Promptlocate: Localizing prompt injection attacks,” in IEEE Symposium on Security and Privacy, 2026.
[34]
[13]
[14]
Y. Jiang, Q. Meng, F. Shang, N. Oo, L. T. H. Minh, H. W. Lim, and B. Sikdar, “Mitre att&ck applications in cybersecurity and the way forward,” arXiv preprint arXiv:2502.10825, 2025.
[15]
Y. Kaya, A. Landerer, S. Pletinckx, M. Zimmermann, C. Kruegel, and G. Vigna, “When ai meets the web: Prompt injection risks in third-party ai chatbot plugins,” arXiv preprint arXiv:2511.05797, 2025.
[16]
A. Liu, B. Feng, B. Xue, B. Wang, B. Wu, C. Lu, C. Zhao, C. Deng, C. Zhang, C. Ruan et al., “Deepseek-v3 technical report,” arXiv preprint arXiv:2412.19437, 2024.
[17]
X. Liu, H. Yu, H. Zhang, Y. Xu, X. Lei, H. Lai, Y. Gu, H. Ding, K. Men, K. Yang, S. Zhang, X. Deng, A. Zeng, Z. Du, C. Zhang, S. Shen, T. Zhang, Y. Su, H. Sun, M. Huang, Y. Dong, and J. Tang, “Agentbench: Evaluating LLMs as agents,” in The Twelfth International Conference on Learning Representations, 2024. [Online]. Available: https://openreview.net/forum?id=zAdUB0aCTQ
[18]
Y. Liu, G. Deng, Y. Li, K. Wang, Z. Wang, X. Wang, T. Zhang, Y. Liu, H. Wang, Y. Zheng et al., “Prompt injection attack against llm-integrated applications,” arXiv preprint arXiv:2306.05499, 2023.
[19]
Y. Liu, Y. Jia, R. Geng, J. Jia, and N. Z. Gong, “Formalizing and benchmarking prompt injection attacks and defenses,” in 33rd USENIX Security Symposium (USENIX Security 24), 2024, pp. 1831–1847.
[20]
MiniMax, “Minimax-01: Scaling foundation models with lightning attention,” 2025. [Online]. Available: https://arxiv.org/abs/2501.08313
[21]
MITRE Corporation, “MITRE ATT&CK tactic TA0006: Credential access,” https://attack.mitre.org/tactics/TA0006/, 2018, accessed 2024.
[22]
——, “MITRE ATT&CK technique T1041: Exfiltration over C2 channel,” https://attack.mitre.org/techniques/T1041/, 2018, accessed 2024.
[35] [36]
[37]
[38]
[39]
[40]
[41]
10
Moonshot AI, “Kimi k2.5: Visual agentic intelligence,” 2026. [Online]. Available: https://arxiv.org/abs/2602.02276 R. Nakano, J. Hilton, S. Balaji, J. Wu, L. Ouyang, C. Kim, C. Hesse, S. Jain, V. Kosaraju, W. Saunders et al., “Webgpt: Browserassisted question-answering with human feedback,” arXiv preprint arXiv:2112.09332, 2021. OpenClaw Team, “OpenClaw: An open agent framework,” https:// openclaw.ai, 2025. V. Outrata, M. A. Polak, and M. Kopp, “Command-line obfuscation detection using small language models,” arXiv preprint arXiv:2408.02637, 2024. L. Ouyang, J. Wu, X. Jiang, D. Almeida, C. L. Wainwright, P. Mishkin, C. Zhang, S. Agarwal, K. Slama, A. Ray, J. Schulman, J. Hilton, F. Kelton, L. E. Miller, M. Simens, A. Askell, P. Welinder, P. F. Christiano, J. Leike, and R. J. Lowe, “Training language models to follow instructions with human feedback,” ArXiv, vol. abs/2203.02155, 2022. [Online]. Available: https://api.semanticscholar.org/CorpusID: 246426909 F. Perez and I. Ribeiro, “Ignore previous prompt: Attack techniques for language models,” arXiv preprint arXiv:2211.09527, 2022. B. Radosevich and J. Halloran, “Mcp safety audit: Llms with the model context protocol allow major security exploits,” ArXiv, vol. abs/2504.03767, 2025. [Online]. Available: https://api.semanticscholar. org/CorpusID:277621603 Y. Ruan, H. Dong, A. Wang, S. Pitis, Y. Zhou, J. Ba, Y. Dubois, C. J. Maddison, and T. Hashimoto, “Identifying the risks of lm agents with an lm-emulated sandbox,” in The Twelfth International Conference on Learning Representations, 2024. M. Russinovich, A. Salem, and R. Eldan, “Great, now write an article about that: The crescendo {Multi-Turn}{LLM} jailbreak attack,” in 34th USENIX Security Symposium (USENIX Security 25), 2025, pp. 2421–2440. T. Schick, J. Dwivedi-Yu, R. Dessı̀, R. Raileanu, M. Lomeli, E. Hambro, L. Zettlemoyer, N. Cancedda, and T. Scialom, “Toolformer: Language models can teach themselves to use tools,” Advances in neural information processing systems, vol. 36, pp. 68 539–68 551, 2023. D. Schmotz, L. Beurer-Kellner, S. Abdelnabi, and M. Andriushchenko, “Skill-inject: Measuring agent vulnerability to skill file attacks,” ArXiv, vol. abs/2602.20156, 2026. [Online]. Available: https://api. semanticscholar.org/CorpusID:285972708 X. Shen, Z. Chen, M. Backes, Y. Shen, and Y. Zhang, “” do anything now”: Characterizing and evaluating in-the-wild jailbreak prompts on large language models,” in Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, 2024, pp. 1671–1685. Q. team, “Qwen3 technical report,” 2025. [Online]. Available: https://arxiv.org/abs/2505.09388 E. Wallace, K. Xiao, R. Leike, L. Weng, J. Heidecke, and A. Beutel, “The instruction hierarchy: Training llms to prioritize privileged instructions,” arXiv preprint arXiv:2404.13208, 2024. H. Wang, C. M. Poskitt, and J. Sun, “Agentspec: Customizable runtime enforcement for safe and reliable llm agents.” in Proceedings of the IEEE/ACM International Conference on Software Engineering, ICSE, 2026, pp. 12–18. Z. Wang, Y. Gao, Y. Wang, S. Liu, H. Sun, H. Cheng, G. Shi, H. Du, and X. Li, “Mcptox: A benchmark for tool poisoning attack on real-world mcp servers,” arXiv preprint arXiv:2508.14925, 2025. S. Yao, J. Zhao, D. Yu, N. Du, I. Shafran, K. R. Narasimhan, and Y. Cao, “React: Synergizing reasoning and acting in language models,” in The eleventh international conference on learning representations, 2022. J. Yi, Y. Xie, B. Zhu, K. Hines, E. Kiciman, G. Sun, X. Xie, and F. Wu, “Benchmarking and defending against indirect prompt injection attacks on large language models,” Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V.1, 2023. [Online]. Available: https://api.semanticscholar.org/CorpusID: 266521508 A. Zeng, X. Lv, Z. Hou, Z. Du, Q. Zheng, B. Chen, D. Yin, C. Ge, C. Huang, C. Xie et al., “Glm-5: from vibe coding to agentic engineering,” arXiv preprint arXiv:2602.15763, 2026.
[42]
Q. Zhan, Z. Liang, Z. Ying, and D. Kang, “Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents,” in Findings of the Association for Computational Linguistics: ACL 2024, 2024, pp. 10 471–10 506. [43] Z. Zhang, S. Cui, Y. Lu, J. Zhou, J. Yang, H. Wang, and M. Huang, “Agent-safetybench: Evaluating the safety of llm agents,” arXiv preprint arXiv:2412.14470, 2024. [44] X. Zong, Z. Shen, L. Wang, Y. Lan, and C. Yang, “Mcp-safetybench: A benchmark for safety evaluation of large language models with real-world mcp servers,” ArXiv, vol. abs/2512.15163, 2025. [Online]. Available: https://api.semanticscholar.org/CorpusID:283920063 [45] A. Zou, Z. Wang, N. Carlini, M. Nasr, J. Z. Kolter, and M. Fredrikson, “Universal and transferable adversarial attacks on aligned language models,” arXiv preprint arXiv:2307.15043, 2023.
11
Rule Synthesis Prompt ρ
A PPENDIX Table IV lists the default pattern library P used by the Content Sanitizer. Each entry specifies the secret category, its coverage, and the redaction token substituted for any matched span.
[System Instruction] You are a security policy synthesizer for an LLM agent runtime. Given the user’s task description, produce a minimal, precise rule set in valid JSON that restricts the agent to actions necessary for the stated task. Do not infer permissions not required by the task. Output only the JSON object; no prose.
Table V enumerates the default entries in Rbase , organized by domain. All entries carry a fixed enforcement action of deny or queue that cannot be overridden by task-specific rules. Categories follow the MITRE ATT&CK enterprise taxonomy [14], including exfiltration (TA0010), credential access (TA0006), persistence (TA0003), and impact (TA0040).
[Context] {conversation_prefix} (populated with H0 : system prompt and user task message only) [Task] Based solely on the task described above, produce a JSON object with the following three fields: • network_rules: an object with two arrays, whitelist (domains the task must contact) and blacklist (domains the task must not contact). Use "*" to indicate no restriction only when network access is genuinely unrestricted by the task. • file_rules: an object with two arrays, whitelist (absolute path prefixes or glob patterns the task may read or write) and blacklist (paths the task must not access). • command_rules: an object with two sub-objects. framework_tools governs framework-native tool calls (e.g., read, write, web_fetch), with allow and deny arrays of tool names. shell_commands governs shell-level execution commands issued via exec (e.g., rm -rf, curl | bash), with allow and deny arrays of command prefixes. A shared queue array lists command categories that must be presented to the user before execution (e.g., "file_deletion", "network_write", "privilege_escalation"). Apply the principle of least privilege: omit permissions not required by the task, and prefer queue over allow when task necessity is ambiguous.
The synthesis prompt ρ is constructed with a S YSTEM I NSTRUCTION block that specifies the output schema, a C ON TEXT block populated with the agent’s conversation prefix H0 , and a TASK block that elicits the three rule categories. The full prompt template is shown in Figure 4.
[Output Schema] { "network_rules": { "whitelist": ["<domain_or_glob>", ...], "blacklist": ["<domain_or_glob>", ...] }, "file_rules": { "whitelist": ["<path_prefix>", ...], "blacklist": ["<path_prefixb>", ...] }, "command_rules": { "framework_tools": { "allow": ["<tool_name>", ...], "deny": ["<tool_name>", ...] }, "shell_commands": { "allow": ["<cmd_prefix>", ...], "deny": ["<cmd_prefix>", ...] }, "queue": ["<category>", ...] } }
Fig. 4: Rule synthesis prompt ρ injected by C LAW G UARD prior to the first tool invocation. The {conversation_prefix} placeholder is replaced with H0 at runtime. 12
TABLE IV: Default sanitization targets in pattern library P. Category
Coverage
Redaction Token
Cloud Provider Credentials AWS Access Key AKIA[0-9A-Z]{16} AWS Secret Key 40-char alphanumeric secret associated with access key GCP API Key AIza[0-9A-Za-z\-_]{35} Azure Storage Key Base64-encoded 88-char key
AWS_ACCESS_KEY_REDACTED AWS_SECRET_KEY_REDACTED GCP_API_KEY_REDACTED AZURE_STORAGE_KEY_REDACTED
Version Control & CI/CD Tokens GitHub Token ghp_, gho_, ghs_, ghr_ prefixes GitLab Token glpat- prefix
GITHUB_TOKEN_REDACTED GITLAB_TOKEN_REDACTED
Communication Platform Tokens Slack Token xox[baprs]- prefix Slack Webhook hooks.slack.com/services/ URL pattern Telegram Bot Token [0-9]{8,10}:[A-Za-z0-9_-]{35} Discord Token mfa. prefix or 59-char base64 token
SLACK_TOKEN_REDACTED SLACK_WEBHOOK_REDACTED TELEGRAM_TOKEN_REDACTED DISCORD_TOKEN_REDACTED
Authentication & Payment Tokens JWT Token Three-part Base64Url header.payload.signature Bearer Token Bearer prefix in Authorization header Stripe Secret Key sk_live_ or sk_test_ prefix Stripe Publishable pk_live_ or pk_test_ prefix
JWT_TOKEN_REDACTED BEARER_TOKEN_REDACTED STRIPE_KEY_REDACTED STRIPE_PUB_KEY_REDACTED
Cryptographic & SSH Material SSH Private Key PEM block -----BEGIN * PRIVATE KEY----RSA Private Key PEM block -----BEGIN RSA PRIVATE KEY----PGP Private Block PEM block -----BEGIN PGP PRIVATE KEY-----
SSH_PRIVATE_KEY_REDACTED RSA_PRIVATE_KEY_REDACTED PGP_PRIVATE_KEY_REDACTED
Database & Connection Strings Database URL (postgres|mysql|mongodb)(s?)://user:pass@host Redis URL redis(s?)://:password@host
DATABASE_URL_REDACTED REDIS_URL_REDACTED
Generic Patterns Generic API Key Generic Secret Generic Password
API_KEY_REDACTED SECRET_REDACTED PASSWORD_REDACTED
api[_\-]?key\s *[=:]\s *[A-Za-z0-9]{20,} secret\s *[=:]\s *[A-Za-z0-9]{16,} password\s *[=:]\s *\S + in config/env files
13
TABLE V: Default baseline safety rules Rbase . Domain
Pattern / Target
Rationale
Action
Shell Commands Command rm -rf /, rm -rf /* Command Fork bomb patterns (:(){:|:&};:) Command chmod 777 /, chown -R root Command Reverse shell patterns (e.g., bash -i >& /dev/tcp/) Command Obfuscated payloads (base64-decoded eval, char-sub pipelines) Command sudo, su, doas Command Package install (apt install, pip install, npm install) Command crontab, systemctl enable/disable/start/stop
Irreversible filesystem wipe Resource exhaustion / DoS Unsafe privilege modification Remote access backdoor Evasion attempt Privilege escalation attempt Environment modification Persistence mechanism
deny deny deny deny deny queue queue queue
Filesystem Paths Path ˜/.ssh/, ˜/.aws/, ˜/.gnupg/ Path /etc/shadow, /etc/passwd, /etc/sudoers Path /boot/, /sys/, /proc/ (write) Path *.pem, *.key, *.p12, *.pfx Path Agent config directory (e.g., .openclaw/) Path Browser profile directories Path ˜/.env, *.env, *secret*
Credential stores System credential files Boot/kernel integrity Cryptographic material Agent self-modification Credential exfiltration Secret files
deny deny deny deny deny deny queue
Outbound Network Network Non-HTTP(S) schemes (e.g., ftp://, sftp://) Network Private IP ranges (10.x, 172.16-31.x, 192.168.x) Network Anonymization networks (*.onion, known Tor exits) Network URL shorteners (bit.ly, t.co, tinyurl.com, etc.) Network Paste/exfiltration sites (pastebin.com, transfer.sh, etc.) Network Tunneling services (ngrok.io, serveo.net, etc.) Network Unlisted endpoints (not in Wnet )
Unmonitored exfiltration SSRF / internal pivoting Covert channel Destination obfuscation Data exfiltration Covert C2 channel Unauthorized exfiltration
deny deny deny deny deny deny queue
14