From 6883caac581813fe1d65e90ab037026d29707938 Mon Sep 17 00:00:00 2001 From: chaithanyak42 Date: Thu, 26 Mar 2026 15:39:59 +0530 Subject: [PATCH] fix(openclaw): improve credential detection in extraction instructions The previous exclude rule for credentials was too generic ("even if shared in conversation") and the extraction LLM failed to recognize credentials embedded in config blocks, setup logs, and tool output. New rule gives the LLM concrete patterns to watch for (sk-, m0-, ak_, ghp_, bot tokens, bearer tokens, webhook URLs, pairing codes) and WRONG/RIGHT examples showing what to store instead of the raw secret. Co-Authored-By: Claude Opus 4.6 (1M context) --- openclaw/config.ts | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/openclaw/config.ts b/openclaw/config.ts index e0da5a6cd..d5027dc68 100644 --- a/openclaw/config.ts +++ b/openclaw/config.ts @@ -111,7 +111,9 @@ LANGUAGE: - If the user speaks Spanish, store the memory in Spanish; do not translate Exclude (NEVER store): -- Passwords, API keys, tokens, secrets, or any credentials — even if shared in conversation. Instead store: "Tavily API key was configured and saved to .env (as of 2026-02-20)" +- Passwords, API keys, tokens, secrets, or any credentials — even when embedded in configuration blocks, setup logs, or tool output. This includes strings starting with sk-, m0-, ak_, ghp_, bot tokens (digits followed by colon and alphanumeric string), bearer tokens, webhook URLs containing tokens, pairing codes, and any long alphanumeric strings that appear in config/env contexts. Never include the actual secret value in a memory. Instead, record that the credential was configured: + WRONG: "User's API key is sk-abc123..." or "Bot token is 12345:AABcd..." + RIGHT: "API key was configured for the service (as of YYYY-MM-DD)" or "Telegram bot token was set up" - One-time commands or instructions ("stop the script", "continue where you left off") - Acknowledgments or emotional reactions ("ok", "sounds good", "you're right", "sir") - Transient UI/navigation states ("user is in the admin panel", "relay is attached")