ClawGuard: Tool을 사용하는 LLM Agent의 Indirect Prompt Injection 방어를 위한 런타임 보안 프레임워크

# ClawGuard Rule Synthesis Prompt 예시 (Figure 4 기반)
# 에이전트 세션 시작 전, 사용자 태스크로부터 규칙 자동 생성

SYSTEM_PROMPT = """
You are a security policy synthesizer for an LLM agent runtime.
Given the user's task description, produce a minimal, precise rule set
in valid JSON that restricts the agent to actions necessary for the stated task.
Do not infer permissions not required by the task.
Output only the JSON object; no prose.
"""

USER_TASK = "Summarize the three most recent blog posts from example-research.org and save to ~/reports/summary.md"

TASK_PROMPT = f"""
Based solely on the task described above, produce a JSON object with:
- network_rules: {{whitelist: [...], blacklist: [...]}}
- file_rules: {{whitelist: [...], blacklist: [...]}}
- command_rules: {{
    framework_tools: {{allow: [...], deny: [...]}},
    shell_commands: {{allow: [...], deny: [...]}},
    queue: [...]
  }}

Task: {USER_TASK}
Apply principle of least privilege.
"""

# 기대 출력 예시
expected_rules = {
  "network_rules": {
    "whitelist": ["example-research.org"],
    "blacklist": ["*.onion", "*.ngrok.io"]
  },
  "file_rules": {
    "whitelist": ["~/reports/"],
    "blacklist": ["~/.ssh/", "~/.aws/", "/etc/"]
  },
  "command_rules": {
    "framework_tools": {
      "allow": ["web_fetch", "write"],
      "deny": ["exec", "read"]
    },
    "shell_commands": {
      "allow": [],
      "deny": ["rm", "curl", "wget", "bash"]
    },
    "queue": ["file_deletion", "network_write"]
  }
}

# 툴 호출 인터셉터 패턴 (pseudo-code)
def intercept_tool_call(tool_name, args, rules):
    # 1. Content Sanitize
    sanitized_args = sanitize_sensitive_data(args)  # AWS key, SSH key 등 마스킹
    
    # 2. Rule Evaluate
    verdict = evaluate_against_rules(tool_name, sanitized_args, rules)
    # verdict: 'allow' | 'deny' | 'amb'
    
    if verdict == 'deny':
        log_and_block(tool_name, sanitized_args)
        return None
    elif verdict == 'amb':
        user_decision = request_user_approval(tool_name, sanitized_args)
        if user_decision != 'approve':
            return None
    
    # 3. Execute & sanitize output
    result = execute_tool(tool_name, sanitized_args)
    return sanitize_output(result)  # 결과에서도 민감 정보 마스킹