Safe Exec

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:18 AM UTC
• Version: 0.3.4

Overview

SafeExec is a disclosed local shell-command guard, but its bypass modes can let agents execute risky commands without real human approval.

Install only if you are comfortable granting this skill command execution with your user privileges. Keep SAFE_EXEC_AUTO_CONFIRM, OPENCLAW_AGENT_CALL, and SAFE_EXEC_DISABLE out of untrusted automation, avoid passing secrets in prompts or SAFEXEC_CONTEXT, do not treat the audit log as tamper-proof, and run risky workflows inside an OS/container sandbox.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (31)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The documented behavior and the static analysis summary indicate multiple bypass paths that undermine the core safety promise of the skill: global disablement, auto-confirmation in non-interactive mode, context-driven downgrades, and direct execution of pending commands. If the implementation also uses eval, an attacker or prompt-injected agent could expand execution scope and run arbitrary shell payloads without the intended human review boundary.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The README states 'All commands require approval by default,' but the rest of the document repeatedly says safe commands execute directly. This is a security-significant contradiction because operators may overtrust the tool and assume all agent-triggered commands are gated, when in fact only pattern-matched commands are intercepted.

Intent-Code Divergence

Low

• Confidence: 90% confidence
• Finding: The README claims audit logs are 'immutable' and 'append-only' without describing any mechanism such as filesystem attributes, permissions, remote logging, or tamper-evident controls. This can mislead users into relying on logs for forensics even though ordinary local log files can usually be edited or deleted.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: In non-interactive mode, the script explicitly skips human confirmation and proceeds toward execution, which undermines the advertised approval workflow. Because the skill is specifically designed to gate dangerous shell commands, allowing environment-controlled bypass of confirmation materially weakens the control and can enable unattended execution of destructive commands.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The approval helper does more than mark a request approved: it directly executes the stored command via eval. This expands the blast radius of the approval step, so any tampering with the pending request file or approval invocation immediately becomes command execution, including shell metacharacter expansion and chaining.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The audit log line manually embeds the result of `jq -Rs .` inside surrounding JSON quotes, which produces invalid JSON such as a doubly quoted or escaped string field. In a safety-control skill, malformed audit logs undermine forensic integrity, can break downstream parsers, and may let rejected high-risk commands disappear from reliable audit processing.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The audit logger manually splices JSON by stripping braces from a caller-supplied JSON fragment and concatenating it into a new object. This is brittle and can produce malformed or misleading audit entries, especially when unexpected content is logged, undermining the integrity of security-relevant audit trails for approvals, bypasses, and executions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation recommends enabling SAFE_EXEC_AUTO_CONFIRM in production to auto-approve LOW/MEDIUM risk commands, but it does not clearly warn that this removes human oversight for actions that can still modify services, firewall rules, files, or scheduled tasks. In the context of an agent command-execution skill, this materially weakens the safety boundary and can let harmful automated actions proceed without review.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The README documents multiple ways to globally disable SafeExec, including an environment variable, without prominently warning that dangerous commands will then bypass interception and approval entirely. Because this skill is specifically meant to mediate risky shell execution, easy disablement with weak warning creates a straightforward path to bypass the control.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The non-interactive mode description says the tool will skip secondary confirmation for agent calls, but it does not clearly explain that this reduces human review in exactly the automation contexts where blast radius can be large. In an agent-execution skill, silent relaxation of checks in non-interactive mode makes unsafe operations easier to carry out at scale.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The README promotes a natural-language install trigger ('Help me install SafeExec skill from ClawdHub') that is broad enough to overlap with ordinary conversation. In agent-driven environments, ambiguous trigger phrases can cause unintended installation actions or be abused via prompt injection/social engineering to install the skill without a clearly delimited command boundary.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The enable/disable phrases ('Enable SafeExec', 'Turn on SafeExec', 'Disable SafeExec') are highly generic and can easily appear in normal dialogue, quoted text, or adversarial prompts. Because this skill controls command-guarding behavior, accidental or injected toggling could disable protections or alter execution policy at sensitive times.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: A broad natural-language installation trigger can cause the platform to install code based on an ordinary conversational phrase rather than an explicit, constrained action. That increases the risk of prompt injection, social engineering, or accidental installation of unreviewed code.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: Ambiguous enablement phrases such as 'Enable SafeExec' or 'Start SafeExec' can overlap with ordinary chat and may activate privileged behavior without a strong activation boundary. In an agent ecosystem, loose activation semantics make prompt injection and unintended tool enablement more likely.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The wrapper copies arbitrary user context into the SAFEXEC_CONTEXT environment variable and then invokes the downstream executable, which can expose sensitive prompts, secrets, file paths, or operational context to child processes, logs, crash reports, or subprocess inspection. In an agent-execution setting, this is more dangerous because user messages may contain credentials or private data and are being propagated implicitly without clear minimization or disclosure.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script treats non-interactive execution as grounds to skip confirmation, then continues to approve and run the command. In the context of a safety wrapper for dangerous commands, this behavior creates a policy bypass where automation or environment variables can remove the human-in-the-loop control the tool is supposed to enforce.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### Changed
- Interactive confirmation is now conditional based on environment
- Human terminal usage maintains safety confirmation
- Agent calls automatically bypass confirmation (prevents hanging)

### Added
- `FIX_REPORT_v0.2.3.md` - Detailed fix report with test results

• Confidence: 93% confidence
• Finding: bypass confirmation

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### Changed
- **SKILL.md** - Added comprehensive metadata section
  - Declares environment variables: SAFE_EXEC_DISABLE, OPENCLAW_AGENT_CALL, SAFE_EXEC_AUTO_CONFIRM
  - Declares write paths: ~/.openclaw/safe-exec/, ~/.openclaw/safe-exec-audit.log
  - Explicitly states: network=false, monitoring=false, credentials=[]
- **SKILL.md** - Added "Security & Privacy" section

• Confidence: 87% confidence
• Finding: AUTO_CONFIRM

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### Fixed
- **Non-interactive hang issue**: Fixed `safe-exec-approve.sh` hanging when called by OpenClaw Agent
- Script now detects non-interactive environments and skips confirmation prompt
- Added `OPENCLAW_AGENT_CALL` and `SAFE_EXEC_AUTO_CONFIRM` environment variable support
- TTY detection using `[[ -t 0 ]]` for automatic environment detection

### Changed

• Confidence: 94% confidence
• Finding: AUTO_CONFIRM

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Agent Mode Clarification

**Concern:** "Agent calls may automatically bypass confirmation... changes protection model"

**Reality:**
- Agent mode prevents agent hanging (agents can't interactively confirm)

• Confidence: 88% confidence
• Finding: bypass confirmation

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### "Instructions imply access to chat/session data... not called out in description"
**Response:** Fixed. Added explicit metadata and "Security & Privacy" section clearly stating what SafeExec does and does NOT do.

### "Agent calls may automatically bypass confirmation... changes protection model"
**Response:** Documented. Agent mode is now clearly explained as an automation feature with full audit logging. Safety checks remain active. This is standard for agent tools (agents can't interactively confirm).

### "Cron-style monitoring... create background process"

• Confidence: 89% confidence
• Finding: bypass confirmation

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- **Safety preserved:**
  - Danger pattern detection still active
  - All commands logged with `agent_auto` mode label
  - Audit trail shows which commands were auto-executed
- **Use case:** Trusted automation with human oversight via audit logs

**Not a "blast radius" increase because:**

• Confidence: 91% confidence
• Finding: auto-execute

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

|------|------|--------|
| `SAFE_EXEC_DISABLE` | 全局禁用 SafeExec | 未设置 |
| `OPENCLAW_AGENT_CALL` | 标识 Agent 调用（自动检测） | 自动 |
| `SAFE_EXEC_AUTO_CONFIRM` | 自动批准 LOW/MEDIUM 风险 | 未设置 |
| `SAFEXEC_CONTEXT` | 用户上下文信息 | 空 |

**使用示例：**

• Confidence: 90% confidence
• Finding: AUTO_CONFIRM

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

{
    "openclaw":
      {
        "env": ["SAFE_EXEC_DISABLE", "OPENCLAW_AGENT_CALL", "SAFE_EXEC_AUTO_CONFIRM"],
        "writes": ["~/.openclaw/safe-exec/", "~/.openclaw/safe-exec-audit.log"],
        "network": false,
        "monitoring": false,

• Confidence: 82% confidence
• Finding: AUTO_CONFIRM

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**Environment variables:**
- `OPENCLAW_AGENT_CALL` - Set by OpenClaw when agent executes commands
- `SAFE_EXEC_AUTO_CONFIRM` - Manual override to auto-approve LOW/MEDIUM risk commands

**Security Note:** Agent mode does not disable safety checks. CRITICAL and HIGH risk commands are still intercepted, logged, and can be reviewed in audit trail.

• Confidence: 84% confidence
• Finding: AUTO_CONFIRM

VirusTotal

63/63 vendors flagged this skill as clean.