🛡️ Clawdbot Output Sentinel

A security hook for Clawdbot that monitors outgoing messages for accidentally leaked credentials, API keys, SSH keys, and tokens.

On critical leaks, it kills the gateway process immediately.

Features

• Scans assistant responses for 25+ credential patterns
• Three severity tiers: Critical, High, Medium
• Telegram alerts on detection
• Automatic gateway kill on critical leaks
• Allowlist for false positives (config references, placeholders)

Installation

clawdbot hooks install isthebaron/clawdbot-output-sentinel
clawdbot hooks enable output-sentinel

Or manually:

cd ~/.clawdbot/hooks
git clone https://github.com/isthebaron/clawdbot-output-sentinel output-sentinel
clawdbot hooks enable output-sentinel

Configuration

Set these environment variables in ~/.clawdbot/.env:

# Required for Telegram alerts
TELEGRAM_BOT_TOKEN=your_bot_token
TELEGRAM_ALERT_CHAT_ID=your_chat_id

Detection Patterns

🔴 CRITICAL (kills gateway)

| Pattern | Example | |---------|---------| | RSA Private Key | -----BEGIN RSA PRIVATE KEY----- | | OpenSSH Private Key | -----BEGIN OPENSSH PRIVATE KEY----- | | EC/DSA/PEM Keys | Various private key headers | | SSH Key Content | AAAB3NzaC1yc2E... (base64) | | AWS Access Key | AKIA... | | Telegram Bot Token | 123456789:ABC... | | GitHub Token | ghp_..., gho_... | | Database URLs | postgres://..., mongodb://... | | Stripe Live Keys | sk_live_... |

🟠 HIGH (alerts only)

| Pattern | Example | |---------|---------| | OpenAI API Key | sk-... | | Anthropic API Key | sk-ant-... | | ElevenLabs Key | | | Google API Key | | | Bearer/Basic Auth | | | JWT Tokens | |