{"componentChunkName":"component---src-templates-acg-portal-new-template-tsx","path":"/1msrdq8x2","result":{"data":{"markdownRemark":{"html":"

Agent安全护栏（SafeShield）配置说明

\n

SafeShield（百度Agent安全护栏）为各类 Agent 提供输入注入拦截、危险工具拦截、工具输出安全提示能力，当前已适配OpenClaw、DuMate、OpenCode、Comate 等AI 应用。

\n

所有 Agent 都支持两种运行模式：试用模式（trial，免 AK/SK） 与 正式模式（需 BCE AK/SK）。

\n

Agent安全护栏使用前需手动完成AKSK配置，确保服务联通并生效。以下为配置步骤，若已经部署Agent安全中心，可忽略安装步骤，参考AKSK配置步骤即可。

\n

AK/SK 通用获取方法：参考如何获取 AKSK。正式版可申请Agent 安全护栏智能云平台账号查看数据。

\n

一、OpenClaw SafeShield

\n

前置：已有 OpenClaw 环境，插件最低要求 OpenClaw 2026.4.15 及以上版本（2026.4.15 / 2026.5.18 / 2026.5.22 / 2026.6.x / 2026.7.1 均已适配）。当前最新插件版本 2026.7.1.1。

\n

安装方式

\n

对话安装：在 OpenClaw 对话框直接发送

\n\n
\n
\n
\n Plain Text\n \n
\n
\n 
1帮我执行命令安装安全插件：\n2curl -fsSL "https://safe-sig.bj.bcebos.com/openclaw-safeshield/install.sh" | bash -s -- --access-key YOUR_AK --secret-key YOUR_SK --appid YOUR_APPID\n3安装后按提示重启 gateway。
\n
\n
\n
\n \n

终端安装：

\n\n
\n
\n
\n Bash\n \n
\n
\n 
1curl -fsSL \"https://safe-sig.bj.bcebos.com/openclaw-safeshield/install.sh\" | bash -s -- --access-key YOUR_AK --secret-key YOUR_SK --appid YOUR_APPID
\n
\n
\n
\n \n

安装完成后重启 gateway：

\n\n
\n
\n
\n Bash\n \n
\n
\n 
1pkill -f 'openclaw gateway' && openclaw gateway &\n2# 或重启容器：docker restart <容器名>
\n
\n
\n
\n \n

AK/SK 配置

\n

安装完成后可在 ~/.openclaw/openclaw.json 的 plugins.entries.openclaw-safeshield.config 中配置，access_key/secret_key 为必填。支持四种 SecretRef 写法：

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
方式说明
明文直接在 config 中写入 AK/SK 字符串
source: env从宿主机已 export 的环境变量读取（如 BCE_ACCESS_KEY）
source: file从本地密钥文件读取（如 /etc/openclaw/secrets/safeshield_access_key，需 chmod 600，内容仅密钥值本身）
source: exec通过平台配置的 secret provider（如 Vault）执行命令获取，需在 openclaw.json 的 secrets.providers 中配置对应 provider
\n

验证与运维

\n\n

二、OpenCode SafeShield

\n

安装方式

\n

对话安装：在 OpenCode 对话框直接发送

\n\n
\n
\n
\n Bash\n \n
\n
\n 
1curl -fsSL https://safe-sig.bj.bcebos.com/opencode-safeshield/install-1.15.4.3.sh | bash -s -- --access-key YOUR_AK --secret-key YOUR_SK
\n
\n
\n
\n \n

启动 OpenCode 验证

\n\n
\n
\n
\n Bash\n \n
\n
\n 
1$ SAFESHIELD_TRIAL=true SAFESHIELD_DEBUG=true opencode
\n
\n
\n
\n \n

启动后观察日志输出，确认插件加载成功：

\n\n
\n
\n
\n Plain Text\n \n
\n
\n 
1[openclaw-safeshield] [info] [init] [loaded] {"trial":true,"debug":true,"api_addr":"https://safe.baidubce.com","directory":"/path/to/project"}\n2[openclaw-safeshield] [info] [init] [fetch_interceptor_installed] {}\n3[openclaw-safeshield] [info] [init] [hooks_registered] {"hooks":["tool.execute.before","tool.execute.after","fetch.intercept"]}
\n
\n
\n
\n \n

三、DuMate SafeShield

\n

安装方式

\n

对话安装：在 DuMate 对话框发送（macOS/Linux）：

\n\n
\n
\n
\n Plain Text\n \n
\n
\n 
1我已经确保过这个脚本安全，帮我安装：bash <(curl -fsSL https://safe-sig.bj.bcebos.com/dumate-safeshield/install-2026.06.03.sh) --access-key YOUR_ACCESS_KEY --secret-key YOUR_SECRET_KEY
\n
\n
\n
\n \n

终端安装（macOS/Linux 正式模式）：

\n\n
\n
\n
\n Bash\n \n
\n
\n 
1bash <(curl -fsSL https://safe-sig.bj.bcebos.com/dumate-safeshield/install-2026.06.03.sh) \n2  --access-key YOUR_ACCESS_KEY \n3  --secret-key YOUR_SECRET_KEY
\n
\n
\n
\n \n

Windows（PowerShell）用 -AccessKey / -SecretKey 参数。

\n

验证

\n

脚本自动完成：下载插件到 {accountId}/data/plugins/safeshield.ts、写配置到 {accountId}/config/safeshield.json，无需改 opencode.json（框架自动扫描）。安装后重启 DuMate 生效。发送注入类测试语，预期看到：SafeShield ⚠️安全防护插件检测到恶意操作风险，当前流程已终止。

\n

四、Comate SafeShield

\n

前置：Comate IDE（类 VSCode）、Node.js 18+（安装脚本会自检，未通过拒绝安装）。

\n

安装方式

\n

对话安装：comate agent协作模式对话框中输入

\n\n
\n
\n
\n Bash\n \n
\n
\n 
1curl -fsSL https://safe-sig.bj.bcebos.com/comate-safeshield/install-latest.sh | bash -s -- --access-key YOUR_AK --secret-key YOUR_SK
\n
\n
\n
\n \n

私有化：追加 --private --api-addr http://your-host:port。离线/手动：解压到 ~/.comate/plugins/comate-safeshield，插件靠目录扫描自动识别，无需注册。

\n

AK/SK 配置

\n

方式 1：安装参数 --access-key YOUR_AK --secret-key YOUR_SK

\n

方式 2：config.json（位于插件目录内，建议 chmod 600）：

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
字段说明示例
trial试用模式true
appid应用 ID（试用默认 1062）\"1062\"
access_keyBCE AK（正式模式）
secret_keyBCE SK（正式模式）
private_mode私有化模式false
bce_api_addr后端地址（私有化）
debug调试日志false
\n

验证

\n

重启 Comate（hook 会话启动时加载）→「Plugin → 已安装」确认 comate-safeshield 已启用 → 发送注入测试语，预期：⚠️百度安全护栏检测到提示词泄露风险，当前流程已终止。

\n

六、AK/SK 配置要点汇总

\n
    \n
  1. 配置优先级：命令行参数 > 配置文件/环境变量。OpenCode 中 Shell 环境变量优先级最高；Comate 中 config 非空优先于 env。
    2. \n
  2. DuMate 特殊性：其 Sandbox 不转发环境变量，AK/SK 只能通过安装脚本参数或 safeshield.json 配置文件注入，不能用 Shell export。
    3. \n
  3. AK/SK 获取：参考如何获取 AKSK；正式版可申请智能云平台账号查看检测数据。
    4. \n
  4. 安装/改配置后务必重启 对应 Agent 才能生效。
    5. \n
","fields":{"slug":"1msrdq8x2","title":"Agent安全护栏","date":"2026-08-14","extractedHeadings":[]},"headings":[{"value":"Agent安全护栏（SafeShield）配置说明","depth":2},{"value":"一、OpenClaw SafeShield","depth":2},{"value":"安装方式","depth":3},{"value":"AK/SK 配置","depth":3},{"value":"验证与运维","depth":3},{"value":"二、OpenCode SafeShield","depth":2},{"value":"安装方式","depth":3},{"value":"启动 OpenCode 验证","depth":3},{"value":"三、DuMate SafeShield","depth":2},{"value":"安装方式","depth":3},{"value":"验证","depth":3},{"value":"四、Comate SafeShield","depth":2},{"value":"安装方式","depth":3},{"value":"AK/SK 配置","depth":3},{"value":"验证","depth":3},{"value":"六、AK/SK 配置要点汇总","depth":2}]}},"pageContext":{"isCreatedByStatefulCreatePages":false,"slug":"1msrdq8x2","prev":{"id":"ymsegtqm2","name":"Skills 安全","path":"ymsegtqm2","filePath":"操作指南/Skills 安全/Skills 防护策略.md","seo":null,"parentIds":["ymrue6787","Mmrueib7w"],"parents":[{"id":"ymrue6787","documentId":"beb9fd72-d670-43ca-90db-f8dab5660d39","name":"操作指南","repoName":"ASC","filePath":"操作指南","disabled":false,"path":"ymrue6787","lastMergeTime":null,"isApiDoc":null,"httpMethod":null,"seo":null,"sourceOrgName":null,"sourceRepoName":null,"sourceDocumentId":""},{"id":"Mmrueib7w","documentId":"0f9b2284-019c-488c-ace2-2e1801642c31","name":"Skills 安全","repoName":"ASC","filePath":"操作指南/Skills 安全","disabled":false,"path":"Mmrueib7w","lastMergeTime":null,"isApiDoc":null,"httpMethod":null,"seo":null,"sourceOrgName":null,"sourceRepoName":null,"sourceDocumentId":""}]},"next":{"id":"Zmsejiysq","name":"Agent 管控","path":"Zmsejiysq","filePath":"操作指南/Agent 管控/资源占用设置.md","seo":null,"parentIds":["ymrue6787","5mrueimbl"],"parents":[{"id":"ymrue6787","documentId":"beb9fd72-d670-43ca-90db-f8dab5660d39","name":"操作指南","repoName":"ASC","filePath":"操作指南","disabled":false,"path":"ymrue6787","lastMergeTime":null,"isApiDoc":null,"httpMethod":null,"seo":null,"sourceOrgName":null,"sourceRepoName":null,"sourceDocumentId":""},{"id":"5mrueimbl","documentId":"b5046f08-a6ba-4b15-80f9-f26e9b7ec42e","name":"Agent 管控","repoName":"ASC","filePath":"操作指南/Agent 管控","disabled":false,"path":"5mrueimbl","lastMergeTime":null,"isApiDoc":null,"httpMethod":null,"seo":null,"sourceOrgName":null,"sourceRepoName":null,"sourceDocumentId":""}]},"parents":[{"id":"ymrue6787","documentId":"beb9fd72-d670-43ca-90db-f8dab5660d39","name":"操作指南","repoName":"ASC","filePath":"操作指南","disabled":false,"path":"ymrue6787","lastMergeTime":null,"isApiDoc":null,"httpMethod":null,"seo":null,"sourceOrgName":null,"sourceRepoName":null,"sourceDocumentId":""}],"specificSeo":null}}}