ClawHub
Back to skill

Security audit

DCG Guard

Security checks for vulnerabilities and agentic risk

Overview

This looks like a real command-guard plugin, but its installer runs unverified remote code and the guard has broad, persistent gateway access with reliability and logging concerns.

Review this before installing. The core idea is coherent, but do not run the provided installer unless you trust the upstream GitHub repository and accept unpinned remote code execution. Prefer a pinned release with checksum verification, and assume the plugin may log full blocked commands and may fail open rather than blocking every dangerous command.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
install.sh:6
Finding

Unpinned Remote Installer Is Downloaded and Executed Directly

Content
View full analysis
/dev/null; then echo "[1/3] Installing DCG binary..." curl -sSL https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/master/install.sh | bash echo "" else ``` `SKILL.md:42-46`: ```bash # 1. Install DCG binary curl -sSL https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/master/install.sh | bash ``` `AGENT_INSTRUCTIONS.md:7-11`: ```bash # Install DCG binary curl -sSL https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/master/install.sh | bash ``` ### Technical Analysis The installer retrieves a shell script from the mutable `master` branch of a personal GitHub repository and immediately sends the response to Bash. It does not pin an immutable commit or release, verify a cryptographic checksum or signature, save the payload for review, or validate its expected contents. Consequently, the effective code executed during installation can differ from the code that existed when this Skill was reviewed. Compromise of the upstream account or repository, a malicious upstream change, or compromise of the delivery trust chain could turn installation into arbitrary code execution. This behavior exceeds the minimum privileges required for the core functionality because `SKILL.md` states that the built-in rules operate without the DCG executable and that DCG is optional. ### Attack Path 1. An attacker compromises the upstream repository, its owner account, or the mutable `master` branch. 2. The attacker modifies the remote `install.sh` to contain malicious shell commands. 3. A user or agent runs this project's `install.sh` or follows either documented manual ...[truncated 865 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
index.ts:99
Finding

Whole-Command Safe-Path Exemption Allows Destructive-Command Bypass

Content
View full analysis
p.test(command)); } ``` The exemption is applied before any built-in destructive-command rule: ```typescript function evaluateBuiltin( command: string ): { id: string; severity: string; reason: string } | null { if (isSafePath(command)) return null; const lower = command.toLowerCase(); for (const rule of BUILTIN_RULES) { ``` The optional binary fallback also fails open: ```typescript function dcgEvaluate(command: string): string | null { if (!existsSync(DCG_BIN)) return null; // No DCG binary = skip silently try { // ... } catch { return null; // fail-open } } ``` ### Technical Analysis `isSafePath` tests the entire command string rather than parsing the target operand of a deletion operation. If any safe-looking substring occurs anywhere in a command, `evaluateBuiltin` immediately returns `null` and skips every built-in rule. This creates a bypass for compound commands, comments, arguments, or unrelated strings that mention `/tmp/`, `node_modules`, cache directories, or another listed pattern. The supposed safe path does not need to be the target of the destructive operation. For example, a command conceptually structured as: ```bash echo /tmp/marker; rm -rf ~ ``` contains `/tmp/`, so the built-in evaluator treats the entire command as exempt even though the second operation targets the home directory. ...[truncated 1501 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
index.ts:220
Finding

Complete Blocked Commands Are Exposed in Gateway Logs

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (27)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
65% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · AGENT_INSTRUCTIONS.md (reported line 4)May include surrounding context.

md
# DCG Guard — Install Instructions for OpenClaw Agents

## What This Is
A plugin that blocks dangerous shell commands (rm -rf, git push --force, git reset --hard, etc.) BEFORE they execute. Zero noise on safe commands. Hard enforcement at the OpenClaw gateway level.

## Quick Install (copy-paste into agent session)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
65% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
# DCG Guard — Install Instructions for OpenClaw Agents

## What This Is
A plugin that blocks dangerous shell commands (rm -rf, git push --force, git reset --hard, etc.) BEFORE they execute. Zero noise on safe commands. Hard enforcement at the OpenClaw gateway level.

## Quick Install (copy-paste into agent session)

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The | bash construction chains untrusted network input directly into shell execution, eliminating any review boundary between download and execution. In setup instructions for agent infrastructure, this can immediately compromise the machine or the broader agent environment if the remote content is altered or malicious.

Content

Scanner excerpt · AGENT_INSTRUCTIONS.md (reported line 10)May include surrounding context.

bash
# Install DCG binary
curl -sSL https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/master/install.sh | bash

# Create plugin directory
mkdir -p ~/clawd/plugins/dcg-guard

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · AGENT_INSTRUCTIONS.md (reported line 52)May include surrounding context.

Run this in your agent:

text
exec: rm -rf /home/test

Expected: blocked with "DCG Guard: [critical] core.filesystem:rm-rf-root-home"

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · AGENT_INSTRUCTIONS.md (reported line 52)May include surrounding context.

Run this in your agent:

text
exec: rm -rf /home/test

Expected: blocked with "DCG Guard: [critical] core.filesystem:rm-rf-root-home"

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill description focuses on command blocking, but the provided instructions also include installing software, linking plugins, restarting services, and executing remotely fetched code. This mismatch is dangerous because users may treat the skill as a passive guard while it actually directs privileged administrative actions and code execution.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The skill description focuses on command blocking, but the provided instructions also include installing software, linking plugins, restarting services, and executing remotely fetched code. This mismatch is dangerous because users may treat the skill as a passive guard while it actually directs privileged administrative actions and code execution.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: dcg-guard
description: "Hard-blocks dangerous shell commands (rm -rf, git push --force, etc.) before execution via OpenClaw's before_tool_call plugin hook. Zero noise on safe commands, ~27ms latency. Uses DCG (Dangerous Command Guard) binary."
metadata:
  {
    "openclaw":

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: dcg-guard
description: "Hard-blocks dangerous shell commands (rm -rf, git push --force, etc.) before execution via OpenClaw's before_tool_call plugin hook. Zero noise on safe commands, ~27ms latency. Uses DCG (Dangerous Command Guard) binary."
metadata:
  {
    "openclaw":
      {
        "requires": { "bins": ["dcg"] },
        "install":
          [
            {
              "id": "script",
              "kind": "script",
              "script": "./install.sh",
              "label": "Install DCG Guard plugin + DCG binary",
            },
          ],
      },
  }
---

# DCG Guard

An OpenClaw plugin that hard-blocks dangerous shell commands before they exec

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
Intercepts every `exec`/`bash` tool call via OpenClaw's `before_tool_call` plugin event. Pipes the command through [DCG](https://github.com/Dicklesworthstone/destructive_command_guard) (Dangerous Command Guard). Safe commands pass silently with zero overhead. Dangerous commands are blocked before execution.

**Blocked (Unix):** `rm -rf ~`, `git push --force`, `git reset --hard`, `git clean -fd`, `git branch -D`
**Blocked (Windows):** `Remove-Item -Recurse -Force`, `rd /s /q`, `del /s`, `Format-Volume`, `reg delete HKLM`
**Allowed:** `ls`, `cat`, `echo`, `git status`, `npm install`, `dir`, `Get-ChildItem`

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The explicit command chain 'curl ... | bash' combines remote retrieval with immediate shell execution, removing any opportunity for validation before code runs. In a skill install context, this is especially risky because it is likely to be executed with user trust and potentially elevated privileges.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

bash
# 1. Install DCG binary
curl -sSL https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/master/install.sh | bash

# 2. Link plugin into OpenClaw
openclaw plugins install -l /path/to/dcg-guard

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The module documentation promises a hard block on destructive commands, but the Unix-path enforcement depends on dcgEvaluate(), which catches all errors and returns null. If the DCG binary is missing, crashes, times out, or emits unexpected output, dangerous Unix-style commands are allowed to proceed, creating a protection-bypass exactly when the guard is unavailable.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Unix-style protection is not self-contained; it relies on an external executable and silently degrades to allow-on-error because dcgEvaluate() returns null inside a broad catch. In a security control that advertises pre-execution hard blocking, silent fail-open behavior lets risky shell commands execute without any indication that the guard has stopped functioning.

Content

No source excerpt is available for this finding.

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The use of a shell pipeline into bash is a direct command-chaining pattern that executes untrusted remote content immediately, leaving no opportunity for review or integrity verification. This materially increases the blast radius of any compromise of the source or transport and is a well-known unsafe installation pattern.

Content

Scanner excerpt · install.sh (reported line 9)May include surrounding context.

sh
# 1. Install DCG binary if missing
if ! command -v dcg &>/dev/null; then
  echo "[1/3] Installing DCG binary..."
  curl -sSL https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/master/install.sh | bash
  echo ""
else
  echo "[1/3] DCG binary already installed: $(which dcg)"

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · AGENT_INSTRUCTIONS.md (reported line 4)May include surrounding context.

md
echo ""
echo "=== DCG Guard installed ==="
echo "Dangerous commands (rm -rf, git push --force, etc.) are now blocked."
echo "Safe commands pass through silently with zero overhead."

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · install.sh (reported line 37)May include surrounding context.

sh
echo ""
echo "=== DCG Guard installed ==="
echo "Dangerous commands (rm -rf, git push --force, etc.) are now blocked."
echo "Safe commands pass through silently with zero overhead."

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · install.sh (reported line 37)May include surrounding context.

sh
claw CLI not found. Install OpenClaw first: https://docs.openclaw.ai"
  exit 1
fi

echo "[2/3] Linking plugin into OpenClaw..."
openclaw plugins install -l "$SCRIPT_DIR" 2>&1

echo "[3/3] Restarting gateway..."
openclaw gateway restart 2>&1 || echo "NOTE: Gateway restart failed. Run 'openclaw gateway restart' manually."

echo ""
echo "=== DCG Guard installed ==="
echo "Dangerous commands (rm -rf, git push --force, etc.) are now blocked."
echo "Safe commands pass through silently with zero overhead."

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill declares installation and shell-related behavior but does not define an explicit tool scope such as permissions or allowed-tools. That omission increases the chance of overbroad execution in agent environments and makes it harder for operators to reason about what the skill may invoke during install or runtime.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file contradicts itself about whether the DCG binary is required: metadata requires it, while the body says no binary dependencies are required and later says DCG is optional. Contradictory dependency claims can cause misconfiguration and false assumptions about whether protections are active.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manual install instructions tell users to pipe a remote script directly into bash without verification or warning. This creates a direct remote code execution path controlled by the remote source, network path, or any upstream compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The plugin sends command content to an external binary without clear user-facing disclosure, which may be sensitive depending on command arguments, and any execution/parsing failure is silently ignored. The more important security issue is the fail-open design: subprocess failure disables enforcement without notifying the caller, weakening the trust boundary around shell execution.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The installer downloads a remote script from GitHub and immediately pipes it to bash, granting arbitrary code execution to whatever content is served at that URL at install time. In the context of a security guard skill, this is especially dangerous because users may trust the installer more than usual, while the manifest describes a narrowly scoped command-blocking function rather than broad installer-side code execution.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
98% confidence
Finding

The instructions tell the agent to fetch and immediately execute a remote install script via curl ... | bash, which bypasses integrity verification, pinning, and review. In an agent-install context this is especially dangerous because a compromised GitHub account, repository, branch, or network path could lead to arbitrary code execution on the host running the agent.

Content

Scanner excerpt · AGENT_INSTRUCTIONS.md (reported line 10)May include surrounding context.

bash
# Install DCG binary
curl -sSL https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/master/install.sh | bash

# Create plugin directory
mkdir -p ~/clawd/plugins/dcg-guard

External Script Fetching

Low
Category
Supply Chain
Confidence
95% confidence
Finding

Fetching and executing an external script from a remote URL introduces supply-chain risk even if the source is legitimate today. Any compromise of the repository, branch, hosting, or transport chain can result in arbitrary code execution on the target system.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

bash
# 1. Install DCG binary
curl -sSL https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/master/install.sh | bash

# 2. Link plugin into OpenClaw
openclaw plugins install -l /path/to/dcg-guard

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The natural-language instruction tells users to 'Ask Mat for permission before retrying,' which embeds an organization-specific individual into the policy flow. This is a natural-language policy concern because it imposes a fixed approver without any indication that the approver is configurable or context-specific.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
index-windows-hybrid.ts:152

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
index.ts:145