A security-focused HTTP proxy that protects AI agents from data exfiltration, secret leaks, and malicious injections.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install pipelock
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install pipelock using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Pipelock Security Harness?
Pipelock acts as a specialized fetch proxy designed to sit between your AI agents and the internet. By implementing a 7-layer scanning pipeline, it ensures that every outbound HTTP request is inspected for vulnerabilities like API key exposure, SSRF attempts, and prompt injection. It is an essential addition to any developer's toolkit within the Openclaw Skills ecosystem for maintaining robust security boundaries when using autonomous coding tools.
This skill provides a critical safety layer by intercepting requests before they reach the public web. It allows developers to define strict policies on what data can leave their local environment, ensuring that sensitive environment variables or high-entropy secrets are never accidentally leaked to external APIs or malicious domains.
Pipelock Security Harness Use Cases
- Prevent AI agents from accidentally leaking Anthropic, OpenAI, or AWS keys in request bodies.
- Block Server-Side Request Forgery (SSRF) attempts targeting internal IP addresses and internal networks.
- Monitor and intercept prompt injection attacks within Model Context Protocol (MCP) server responses.
- Audit agent behavior using the Openclaw Skills framework to ensure compliance with corporate security policies.
- Detect unauthorized workspace modifications through file integrity monitoring.
How Pipelock Security Harness Works
- The user initializes Pipelock with a configuration preset tailored to their specific IDE or agent environment (e.g., balanced, strict, or audit).
- The proxy service is launched, listening locally (defaulting to port 8888) for outbound HTTP traffic from the agent.
- The agent's outbound requests are routed through the proxy endpoint where they undergo multi-layer inspection including DLP patterns and entropy analysis.
- Pipelock evaluates the request against domain blocklists, rate limits, and sensitive data patterns like environment variable values.
- Upon detecting a threat, the tool executes a predefined action such as blocking the request, stripping sensitive data, or prompting for human approval.
Pipelock Security Harness Setup
To integrate this security layer into your Openclaw Skills workflow, follow these installation steps:
# Install via Homebrew (macOS/Linux)
brew install luckyPipewrench/tap/pipelock
# Or install via Go
go install github.com/luckyPipewrench/pipelock/cmd/pipelock@latest
# Generate a balanced security configuration
pipelock generate config --preset balanced -o pipelock.yaml
# Start the security proxy
pipelock run --config pipelock.yaml
Pipelock Security Harness Data Schema & Taxonomy
Pipelock utilizes a YAML-based configuration for rules and uses standard HTTP structures for its proxy interface. Data is organized as follows:
| Component | Format | Description |
|---|---|---|
| Configuration | YAML | Stores presets, blocklists, and detection thresholds |
| Proxy Interface | HTTP/REST | Default listener at http://localhost:8888/fetch |
| Integrity Database | Binary/Local | Database for tracking and verifying workspace file hashes |
| Detection Logs | CLI Output/Logs | Audit trail of flagged, stripped, or blocked requests |
Pipelock Security Harness Advanced Features
- MCP Proxy wrapper for scanning Model Context Protocol server responses for prompt injection in real-time.
- Workspace Integrity suite to detect and flag unauthorized local file modifications by agents.
- Human-in-the-loop 'ask' mode which triggers a terminal prompt for manual approval of suspicious outbound requests.
- Custom entropy analysis to identify and flag potential secrets not covered by standard regex patterns.
- Specialized integration presets tuned specifically for Claude Code, Cursor IDE, and other Openclaw Skills compatible agents.
SKILL.md
Loading
Related Openclaw Skills
Todo Management
A lightweight, per-workspace SQLite todo manager operated via a dedicated shell script for seamless task tracking.
Web Search Skill
A high-performance skill that enables AI agents to query the internet for real-time information using the DuckDuckGo API.
SafeExec
Protect your system with an automated command interception and human-in-the-loop approval workflow for AI agent shell operations.
ClawShell
ClawShell is a security-focused tool that intercepts shell commands and requires push notification approval for high-risk operations.
Bounty Hunter Pro
An autonomous bug bounty hunting and vulnerability scanning skill featuring multi-stage LLM analysis and strict scope safety.
WalletLens
An advanced multi-chain wallet analyzer providing USD valuations, ENS resolution, and sophisticated bot detection for EVM networks.
Featured*
