Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Pipelock is a fetch proxy that intercepts outbound HTTP requests from AI agents and runs them through a 7-layer scanner pipeline. It detects credential leaks, SSRF attempts, prompt injection, data exfiltration, and env var exposure before requests leave the machine. Configure responses as block, strip, warn, or interactive approval.
Running security checks at the network layer catches threats regardless of which agent framework or tool makes the request, without requiring code changes in each tool.
When to use it
- Blocking an agent from leaking API keys in request bodies
- Preventing SSRF when an agent fetches user-supplied URLs
- Scanning MCP server responses for prompt injection
- Auditing all outbound agent traffic without blocking
- Detecting unauthorized workspace file changes during agent runs
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: wrap my filesystem MCP server with security scanning
- 1Generate a pipelock config with the balanced preset: pipelock generate config --preset balanced -o pipelock.yaml
- 2Start pipelock proxy: pipelock run --config pipelock.yaml
- 3Wrap the MCP server: pipelock mcp proxy -- npx @modelcontextprotocol/server-filesystem /path/to/dir
- 4Agent requests now pass through the 7-layer scanner before reaching the network
- 5Any detected API key leak or prompt injection triggers the configured action (block/strip/warn/ask)
MCP server running behind pipelock proxy with credential leak and prompt injection detection active
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.