Input Guard

**Judgement:** Input Guard is a strong, opinionated defensive layer for OpenClaw-style agents that consume untrusted text. It is well-suited as a default prefilter in any workflow that fetches external content. **What it does well** - Detects a broad range of prompt-injection tactics (instruction override, role/system spoofing, jailbreaks, data exfiltration, encoded payloads, etc.). - Works offline with pure-Python pattern matching and no external dependencies; can optionally add an LLM layer for deeper semantic checks. - Provides clear severities (SAFE → CRITICAL), consistent exit codes, and JSON output that is easy to script around. - Offers good operational guidance: integration templates, AGENTS.md snippet, alert formats, MoltThreats reporting hooks. **Key risks / limitations** - Pattern-based scanning will inevitably have both false negatives (novel or highly obfuscated attacks) and false positives (overly strict regex hits), especially at higher sensitivities. - LLM-based analysis improves coverage but introduces latency, cost, and dependence on external APIs; it can still be manipulated and must not be treated as infallible. - Severity thresholds (e.g., blocking on MEDIUM+) are policy choices; aggressive settings may disrupt workflows if not tuned and monitored. **Recommended scenarios** - As a **mandatory pre-processing step** for any skill that ingests external web pages, search results, or social media content. - In **security-conscious or regulated environments** where prompt injection and data-exfiltration attempts must be surfaced and logged to humans. - For **pipelines that call third-party APIs** whose outputs can be influenced by adversaries (user-content platforms, forums, social feeds). - With LLM scanning enabled (`--llm` or `--llm-auto`) for **high-stakes or high-risk inputs**, while using pattern-only scanning for fast, bulk, or cost-sensitive use cases.