openclaw-shield-upx_skill

Overview

This skill provides security monitoring and incident tooling for OpenClaw agents using the UPX Shield plugin. It helps check Shield health, review recent events, inspect the redaction vault, and manage generated security cases. Use it when you need quick, actionable status and event context from Shield.

How this skill works

The skill queries the local Shield plugin and UPX platform endpoints to report connection state, event counts, and last sync details. It reads the local event buffer and redaction vault (hashed IDs and token summaries) and exposes case listings and full case details. Actions include forcing an immediate sync, acknowledging or resolving cases, and filtered event retrieval in JSON or human-friendly formats.

When to use it

• Verify Shield is running and connected to the UPX platform
• Inspect recent captured events or filter logs by type/time
• View agent/workspace inventory and redaction summaries
• Force a sync to troubleshoot connectivity or delivery issues
• Review, acknowledge, or resolve generated security cases or alerts

Best practices

• Run openclaw shield status first to determine health before deeper troubleshooting
• Use openclaw shield logs with filters (--type, --since, --last) to reduce noise
• Force a sync (openclaw shield flush) for transient connectivity failures before escalating
• Acknowledge pending cases (shield.cases_ack) to avoid repeated notifications; resolve with clear resolution and root cause
• Keep the @upx-us/shield plugin updated to avoid version mismatches that can increase quarantines

Example use cases

• User asks “Is Shield running?” — run openclaw shield status and explain Connected/Disconnected guidance
• Investigate a recent alert — fetch case detail (shield.case_detail) and review associated events and playbook
• Audit redaction behavior — run openclaw shield vault redactions to show token categories and counts
• Count agents on the host — run openclaw shield vault show to list hashed agent/workspace inventory
• Troubleshoot sync failures — run openclaw shield flush and report last sync/time and failure counts