<!-- source: https://deepwiki.com/qhkm/zeptoclaw/6.2-safetylayer-components -->

# SafetyLayer Components

- src/audit.rs
- src/cli/tools.rs
- src/kernel/gate.rs
- src/kernel/mod.rs
- src/kernel/registrar.rs
- src/safety/chain_alert.rs
- src/safety/leak_detector.rs
- src/safety/mod.rs
- src/safety/taint.rs
- src/security/shell.rs
- src/session/history.rs
- src/tools/browser.rs

The SafetyLayer is ZeptoClaw's multi-layered security subsystem that protects against prompt injection attacks, secret leakage, policy violations, and unsafe tool chains. It orchestrates a pipeline of specialized modules to ensure that both inputs to tools and outputs returning to the LLM satisfy security constraints.

## Architecture Overview

The `SafetyLayer` acts as a unified orchestrator that sequences length validation, structural checks, leak detection, and policy enforcement [src/safety/mod.rs99-104](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/safety/mod.rs#L99-L104) It is conditionally instantiated in the `ZeptoKernel` based on `config.safety.enabled` [src/kernel/mod.rs92-96](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/kernel/mod.rs#L92-L96) and shared across all tool execution paths, including the `AgentLoop` and the MCP server [src/kernel/gate.rs4-10](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/kernel/gate.rs#L4-L10)

**SafetyLayer Orchestration Flow**

```

```

Sources: [src/kernel/gate.rs131-175](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/kernel/gate.rs#L131-L175) [src/safety/mod.rs117-134](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/safety/mod.rs#L117-L134)

## Component: Content Validator

**Module**: `src/safety/validator.rs`

The `ContentValidator` performs structural checks to detect obfuscation or malformed data before expensive pattern matching occurs [src/safety/mod.rs168-178](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/safety/mod.rs#L168-L178)

Sources: [src/safety/mod.rs53](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/safety/mod.rs#L53-L53) [src/safety/mod.rs156-178](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/safety/mod.rs#L156-L178) [src/safety/validator.rs1-20](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/safety/validator.rs#L1-L20)

## Component: Policy Engine

**Module**: `src/safety/policy.rs`

The `PolicyEngine` enforces rules using a `RegexSet` for high-performance first-pass matching. It categorizes threats by severity and recommends actions such as `Block`, `Sanitize`, or `Warn`.

### Policy Rules and Patterns

The engine detects 21 patterns across 7 core rules.

### Field-Aware Scanning

The kernel applies policies intelligently based on the tool being called. For example, `write_file` suppresses `shell_injection` checks for the file body to allow saving legitimate scripts, while still enforcing the check on the `path` argument [src/kernel/gate.rs75-93](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/kernel/gate.rs#L75-L93)

Sources: [src/kernel/gate.rs23](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/kernel/gate.rs#L23-L23) [src/kernel/gate.rs65-117](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/kernel/gate.rs#L65-L117) [src/safety/policy.rs1-50](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/safety/policy.rs#L1-L50)

## Component: Leak Detector

**Module**: `src/safety/leak_detector.rs`

The `LeakDetector` identifies 22 specific secret patterns in tool outputs [src/safety/leak_detector.rs67-131](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/safety/leak_detector.rs#L67-L131) It supports `LeakAction::Redact`, which masks the middle of a secret while preserving prefixes and suffixes (e.g., `sk-ant-a***7890`) [src/safety/leak_detector.rs27-28](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/safety/leak_detector.rs#L27-L28)

**Key Pattern Categories:**

- Cloud/AI Keys: Anthropic ( sk-ant-api ), OpenAI ( sk- ), AWS ( AKIA ), Google API ( AIza ) src/safety/leak_detector.rs 68-97
- VCS/Dev: GitHub PAT ( github_pat_ ), GitHub Token ( ghp_ ), Stripe keys src/safety/leak_detector.rs 78-92
- Infrastructure: Slack tokens ( xoxb- , xoxp- ), Bearer tokens, JWTs src/safety/leak_detector.rs 99-130
- Files: PEM Private Keys (always triggers LeakAction::Block ) src/safety/leak_detector.rs 114-118

Sources: [src/safety/leak_detector.rs67-131](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/safety/leak_detector.rs#L67-L131) [src/safety/mod.rs182-205](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/safety/mod.rs#L182-L205)

## Component: Taint Tracking

**Module**: `src/safety/taint.rs`

The `TaintEngine` provides data-flow-aware security by tracking the provenance of data using pragmatic substring matching [src/safety/taint.rs1-7](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/safety/taint.rs#L1-L7) It ensures that data from untrusted sources does not flow into dangerous "sink" tools.

### Taint Labels and Sinks

Data is labeled based on the tool that produced it.

**Enforcement at Sinks:**
The engine blocks execution if a "sink" tool receives data containing a restricted label [src/kernel/gate.rs157-168](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/kernel/gate.rs#L157-L168)

```

```

Sources: [src/kernel/gate.rs157-168](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/kernel/gate.rs#L157-L168) [src/safety/taint.rs155-176](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/safety/taint.rs#L155-L176)

## Component: Tool Chain Alerting

**Module**: `src/safety/chain_alert.rs`

The `ChainTracker` monitors the sequence of tool calls within a session to detect multi-step attack patterns [src/safety/chain_alert.rs29-35](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/safety/chain_alert.rs#L29-L35) Unlike the Policy Engine, it is purely observational and logs warnings rather than blocking execution [src/safety/chain_alert.rs4-5](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/safety/chain_alert.rs#L4-L5)

**Detected Dangerous Sequences:**

- write-then-execute : filesystem_write followed by shell_execute (potential code injection) src/safety/chain_alert.rs 13-16
- execute-then-fetch : shell_execute followed by web_fetch (potential data exfiltration) src/safety/chain_alert.rs 17-20
- memory-then-execute : longterm_memory followed by shell_execute (potential memory poisoning exploitation) src/safety/chain_alert.rs 21-24

Sources: [src/safety/chain_alert.rs9-25](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/safety/chain_alert.rs#L9-L25) [src/safety/chain_alert.rs61-83](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/safety/chain_alert.rs#L61-L83)

## Component: Shell Security

**Module**: `src/security/shell.rs`

Specific to shell command execution, this component provides regex-based pattern matching to prevent dangerous shell operations, serving as a defense-in-depth layer alongside container isolation [src/security/shell.rs1-4](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/security/shell.rs#L1-L4)

**Security Features:**

- Git Normalization : Strips global options (like -C or --git-dir ) to prevent subcommands from bypassing filters src/security/shell.rs 49-98
- Blocked Patterns : Includes 15+ regex patterns for pipes to shell, reverse shells, destructive root operations ( rm -rf / ), and fork bombs src/security/shell.rs 107-158
- Literal Blocklist : Protects sensitive system paths like /etc/shadow and .ssh/authorized_keys src/security/shell.rs 161-175

Sources: [src/security/shell.rs1-175](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/security/shell.rs#L1-L175)

## Integration in Tool Execution

The kernel's `execute_tool` function serves as the primary enforcement point for all SafetyLayer components [src/kernel/gate.rs131-139](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/kernel/gate.rs#L131-L139)

1. Input Scan : Checks arguments against SafetyLayer (which includes PolicyEngine , LeakDetector , and ContentValidator ) src/kernel/gate.rs 148-154
2. Taint Sink Check : Queries the TaintEngine (read lock) to see if input contains snippets from untrusted sources src/kernel/gate.rs 157-168
3. Tool Execution : Runs the actual tool logic via registry.execute_with_context src/kernel/gate.rs 171-178
4. Output Scan : Scans the result for leaks and policy violations src/kernel/gate.rs 181-190
5. Taint Labeling : Updates the TaintEngine (write lock) with snippets from the output src/kernel/gate.rs 193-203
6. Audit Recording : Records the outcome in the hash chain src/kernel/gate.rs 43-47

Sources: [src/kernel/gate.rs131-205](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/kernel/gate.rs#L131-L205)

## Audit Logging and Integrity

Security events are recorded in a structured audit log [src/audit.rs1-5](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/audit.rs#L1-L5) ZeptoClaw maintains an `AuditHashChain` to ensure the integrity of security logs, preventing tampering with the record of blocked actions [src/audit.rs120-130](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/audit.rs#L120-L130)

Sources: [src/audit.rs14-35](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/audit.rs#L14-L35) [src/audit.rs106-115](https://github.com/qhkm/zeptoclaw/blob/2c743d31/src/audit.rs#L106-L115)
