ClawHub
Back to skill

Security audit

DCG Guard

Security checks for vulnerabilities and agentic risk

Overview

This looks like a real command-guard plugin, but its installer runs unverified remote code and the guard has broad, persistent gateway access with reliability and logging concerns.

Review this before installing. The core idea is coherent, but do not run the provided installer unless you trust the upstream GitHub repository and accept unpinned remote code execution. Prefer a pinned release with checksum verification, and assume the plugin may log full blocked commands and may fail open rather than blocking every dangerous command.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
install.sh:6
Finding
Unpinned Remote Installer Is Downloaded and Executed Directly<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:6-11`; also documented in `SKILL.md:42-46` and `AGENT_INSTRUCTIONS.md:7-11` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code `install.sh:6-11`: ```bash # 1. Install DCG binary if missing if ! command -v dcg &>/dev/null; then echo "[1/3] Installing DCG binary..." curl -sSL https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/master/install.sh | bash echo "" else ``` `SKILL.md:42-46`: ```bash # 1. Install DCG binary curl -sSL https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/master/install.sh | bash ``` `AGENT_INSTRUCTIONS.md:7-11`: ```bash # Install DCG binary curl -sSL https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/master/install.sh | bash ``` ### Technical Analysis The installer retrieves a shell script from the mutable `master` branch of a personal GitHub repository and immediately sends the response to Bash. It does not pin an immutable commit or release, verify a cryptographic checksum or signature, save the payload for review, or validate its expected contents. Consequently, the effective code executed during installation can differ from the code that existed when this Skill was reviewed. Compromise of the upstream account or repository, a malicious upstream change, or compromise of the delivery trust chain could turn installation into arbitrary code execution. This behavior exceeds the minimum privileges required for the core functionality because `SKILL.md` states that the built-in rules operate without the DCG executable and that DCG is optional. ### Attack Path 1. An attacker compromises the upstream repository, its owner account, or the mutable `master` branch. 2. The attacker modifies the remote `install.sh` to contain malicious shell commands. 3. A user or agent runs this project's `install.sh` or follows either documented manual ...[truncated 865 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove all `curl | bash` instructions and make the optional DCG installation explicitly opt-in. 2. Fetch a versioned release artifact from an immutable release or commit rather than `master`. 3. Download the artifact to a local file before executing or installing it. 4. Publish and verify a SHA-256 digest or, preferably, a signature tied to a documented trusted key. 5. Abort installation if integrity verification fails. 6. Display the source, version, destination, and expected checksum before installation. 7. Prefer a trusted package manager with locked versions and integrity metadata where available. 8. Update `install.sh`, `SKILL.md`, and `AGENT_INSTRUCTIONS.md` consistently so users are not directed to the unsafe command through documentation. A safer sequence should follow this model: ```bash curl --fail --location --output /tmp/dcg-installer.sh \ "https://example.invalid/dcg/releases/download/vX.Y.Z/install.sh" printf '%s %s\n' "$EXPECTED_SHA256" /tmp/dcg-installer.sh | sha256sum --check - less /tmp/dcg-installer.sh bash /tmp/dcg-installer.sh ``` The URL, release version, and checksum must be real, immutable, and maintained by the project. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
index.ts:99
Finding
Whole-Command Safe-Path Exemption Allows Destructive-Command Bypass<![CDATA[ ## Vulnerability Details **File Location**: `index.ts:99-114` **Vulnerability Type**: Destructive-command filter bypass caused by unsafe substring-based exemption **Risk Level**: High ### Vulnerable Code ```typescript // Paths that are always safe to delete (temp, cache, test dirs) const SAFE_PATH_PATTERNS = [ /[/\\]temp[/\\]/i, /[/\\]tmp[/\\]/i, /[/\\]cache[/\\]/i, /[/\\]__pycache__[/\\]/i, /[/\\]node_modules[/\\]/i, /[/\\]\.cache[/\\]/i, /[/\\]AppData[/\\]Local[/\\]Temp[/\\]/i, /tmp_dcg_test/i, /\/tmp\//i, ]; function isSafePath(command: string): boolean { return SAFE_PATH_PATTERNS.some((p) => p.test(command)); } ``` The exemption is applied before any built-in destructive-command rule: ```typescript function evaluateBuiltin( command: string ): { id: string; severity: string; reason: string } | null { if (isSafePath(command)) return null; const lower = command.toLowerCase(); for (const rule of BUILTIN_RULES) { ``` The optional binary fallback also fails open: ```typescript function dcgEvaluate(command: string): string | null { if (!existsSync(DCG_BIN)) return null; // No DCG binary = skip silently try { // ... } catch { return null; // fail-open } } ``` ### Technical Analysis `isSafePath` tests the entire command string rather than parsing the target operand of a deletion operation. If any safe-looking substring occurs anywhere in a command, `evaluateBuiltin` immediately returns `null` and skips every built-in rule. This creates a bypass for compound commands, comments, arguments, or unrelated strings that mention `/tmp/`, `node_modules`, cache directories, or another listed pattern. The supposed safe path does not need to be the target of the destructive operation. For example, a command conceptually structured as: ```bash echo /tmp/marker; rm -rf ~ ``` contains `/tmp/`, so the built-in evaluator treats the entire command as exempt even though the second operation targets the home directory. ...[truncated 1501 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove the whole-command early return: ```typescript if (isSafePath(command)) return null; ``` 2. Parse shell syntax into individual commands and identify the actual operands of destructive operations. 3. Apply a safe-path exception only after: - A destructive operation has been identified. - Its target operand has been unambiguously parsed. - The target has been canonicalized. - The canonical target is confirmed to reside under a specifically approved directory. 4. Evaluate every component of compound commands independently; one safe component must never exempt another component. 5. Treat ambiguous parsing, malformed DCG output, timeout, and evaluator failure as a block or explicit approval requirement for destructive operations. 6. Avoid generic exemptions such as any path containing `cache`, `tmp`, or `node_modules`; verify directory boundaries and resolved paths. 7. Add regression tests for compound commands, comments, quoted strings, command substitutions, symbolic links, traversal sequences, and mixed separators. 8. Clearly document whether protection is fail-open or fail-closed; do not describe fail-open behavior as a hard security guarantee. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
index.ts:220
Finding
Complete Blocked Commands Are Exposed in Gateway Logs<![CDATA[ ## Vulnerability Details **File Location**: `index.ts:220-234` **Vulnerability Type**: Sensitive information exposure through logging **Risk Level**: Medium ### Vulnerable Code ```typescript if (builtinResult) { console.warn( `[dcg-guard] BLOCKED [${builtinResult.severity}]: ${command}\n Rule: ${builtinResult.id}\n Reason: ${builtinResult.reason}` ); return { block: true, blockReason: `🛡️ DCG Guard [${builtinResult.severity}] ${builtinResult.id}\n\n${builtinResult.reason}\n\nCommand: ${command}\n\nThis command was blocked because it is destructive or irreversible. Ask the user for explicit permission before retrying.`, }; } // 2. DCG binary fallback (unix, ~27ms, optional) const dcgResult = dcgEvaluate(command); if (dcgResult) { console.warn(`[dcg-guard] BLOCKED (DCG): ${command}\n ${dcgResult}`); ``` ### Technical Analysis The plugin interpolates the complete shell command into `console.warn` whenever a command is blocked. Shell commands frequently contain sensitive arguments such as access tokens, passwords, private repository URLs, database connection strings, API keys, file paths, or confidential data passed inline. Because the plugin operates at the gateway level, these messages may be retained in gateway logs or forwarded to centralized logging systems. This broadens access to command contents beyond the original user and process. Returning the complete command in `blockReason` can additionally expose it through agent transcripts or user interfaces, depending on OpenClaw's handling of hook responses. Logging the complete command is not required to enforce blocking. Rule identifier, severity, timestamp, and a request correlation identifier are sufficient for routine auditing. ### Attack Path 1. A user or agent issues a command containing sensitive data. 2. The command also matches a built-in or DCG destructive-command rule. 3. The plugin blocks the command. 4. The complete command, including sensitive arguments, ...[truncated 845 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Do not log the complete command by default. 2. Record only non-sensitive metadata, such as: - Rule identifier - Severity - Tool name - Timestamp - Correlation or request identifier 3. Remove the complete command from `blockReason`, or provide a safely truncated and redacted representation only when required by the interface. 4. If command-level debugging is necessary, place it behind an explicit debug option that is disabled by default. 5. Implement redaction for credentials in URLs, common secret-bearing flags, environment assignments, authorization headers, and connection strings. 6. Configure restrictive log permissions, short retention periods, and controls preventing unnecessary forwarding to third-party collectors. 7. Document that even redaction is imperfect and discourage users from placing secrets directly in command-line arguments. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (27)

Tool Parameter Abuse

High
Category
Tool Misuse
Content
# DCG Guard — Install Instructions for OpenClaw Agents

## What This Is
A plugin that blocks dangerous shell commands (rm -rf, git push --force, git reset --hard, etc.) BEFORE they execute. Zero noise on safe commands. Hard enforcement at the OpenClaw gateway level.

## Quick Install (copy-paste into agent session)
Confidence
65% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
# DCG Guard — Install Instructions for OpenClaw Agents

## What This Is
A plugin that blocks dangerous shell commands (rm -rf, git push --force, git reset --hard, etc.) BEFORE they execute. Zero noise on safe commands. Hard enforcement at the OpenClaw gateway level.

## Quick Install (copy-paste into agent session)
Confidence
65% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Chaining Abuse

High
Category
Tool Misuse
Content
```bash
# Install DCG binary
curl -sSL https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/master/install.sh | bash

# Create plugin directory
mkdir -p ~/clawd/plugins/dcg-guard
Confidence
99% confidence
Finding
The `| bash` construction chains untrusted network input directly into shell execution, eliminating any review boundary between download and execution. In setup instructions for agent infrastructure, this can immediately compromise the machine or the broader agent environment if the remote content is altered or malicious.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
Run this in your agent:
```
exec: rm -rf /home/test
```

Expected: blocked with "DCG Guard: [critical] core.filesystem:rm-rf-root-home"
Confidence
90% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
Run this in your agent:
```
exec: rm -rf /home/test
```

Expected: blocked with "DCG Guard: [critical] core.filesystem:rm-rf-root-home"
Confidence
90% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The skill description focuses on command blocking, but the provided instructions also include installing software, linking plugins, restarting services, and executing remotely fetched code. This mismatch is dangerous because users may treat the skill as a passive guard while it actually directs privileged administrative actions and code execution.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The skill description focuses on command blocking, but the provided instructions also include installing software, linking plugins, restarting services, and executing remotely fetched code. This mismatch is dangerous because users may treat the skill as a passive guard while it actually directs privileged administrative actions and code execution.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
---
name: dcg-guard
description: "Hard-blocks dangerous shell commands (rm -rf, git push --force, etc.) before execution via OpenClaw's before_tool_call plugin hook. Zero noise on safe commands, ~27ms latency. Uses DCG (Dangerous Command Guard) binary."
metadata:
  {
    "openclaw":
Confidence
70% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High
Category
YARA Match
Content
---
name: dcg-guard
description: "Hard-blocks dangerous shell commands (rm -rf, git push --force, etc.) before execution via OpenClaw's before_tool_call plugin hook. Zero noise on safe commands, ~27ms latency. Uses DCG (Dangerous Command Guard) binary."
metadata:
  {
    "openclaw":
      {
        "requires": { "bins": ["dcg"] },
        "install":
          [
            {
              "id": "script",
              "kind": "script",
              "script": "./install.sh",
              "label": "Install DCG Guard plugin + DCG binary",
            },
          ],
      },
  }
---

# DCG Guard

An OpenClaw plugin that hard-blocks dangerous shell commands before they exec
Confidence
75% confidence
Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
Intercepts every `exec`/`bash` tool call via OpenClaw's `before_tool_call` plugin event. Pipes the command through [DCG](https://github.com/Dicklesworthstone/destructive_command_guard) (Dangerous Command Guard). Safe commands pass silently with zero overhead. Dangerous commands are blocked before execution.

**Blocked (Unix):** `rm -rf ~`, `git push --force`, `git reset --hard`, `git clean -fd`, `git branch -D`
**Blocked (Windows):** `Remove-Item -Recurse -Force`, `rd /s /q`, `del /s`, `Format-Volume`, `reg delete HKLM`
**Allowed:** `ls`, `cat`, `echo`, `git status`, `npm install`, `dir`, `Get-ChildItem`
Confidence
90% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Chaining Abuse

High
Category
Tool Misuse
Content
```bash
# 1. Install DCG binary
curl -sSL https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/master/install.sh | bash

# 2. Link plugin into OpenClaw
openclaw plugins install -l /path/to/dcg-guard
Confidence
98% confidence
Finding
The explicit command chain 'curl ... | bash' combines remote retrieval with immediate shell execution, removing any opportunity for validation before code runs. In a skill install context, this is especially risky because it is likely to be executed with user trust and potentially elevated privileges.

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The module documentation promises a hard block on destructive commands, but the Unix-path enforcement depends on dcgEvaluate(), which catches all errors and returns null. If the DCG binary is missing, crashes, times out, or emits unexpected output, dangerous Unix-style commands are allowed to proceed, creating a protection-bypass exactly when the guard is unavailable.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
Unix-style protection is not self-contained; it relies on an external executable and silently degrades to allow-on-error because dcgEvaluate() returns null inside a broad catch. In a security control that advertises pre-execution hard blocking, silent fail-open behavior lets risky shell commands execute without any indication that the guard has stopped functioning.

Chaining Abuse

High
Category
Tool Misuse
Content
# 1. Install DCG binary if missing
if ! command -v dcg &>/dev/null; then
  echo "[1/3] Installing DCG binary..."
  curl -sSL https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/master/install.sh | bash
  echo ""
else
  echo "[1/3] DCG binary already installed: $(which dcg)"
Confidence
99% confidence
Finding
The use of a shell pipeline into bash is a direct command-chaining pattern that executes untrusted remote content immediately, leaving no opportunity for review or integrity verification. This materially increases the blast radius of any compromise of the source or transport and is a well-known unsafe installation pattern.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
echo ""
echo "=== DCG Guard installed ==="
echo "Dangerous commands (rm -rf, git push --force, etc.) are now blocked."
echo "Safe commands pass through silently with zero overhead."
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
echo ""
echo "=== DCG Guard installed ==="
echo "Dangerous commands (rm -rf, git push --force, etc.) are now blocked."
echo "Safe commands pass through silently with zero overhead."
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High
Category
YARA Match
Content
claw CLI not found. Install OpenClaw first: https://docs.openclaw.ai"
  exit 1
fi

echo "[2/3] Linking plugin into OpenClaw..."
openclaw plugins install -l "$SCRIPT_DIR" 2>&1

echo "[3/3] Restarting gateway..."
openclaw gateway restart 2>&1 || echo "NOTE: Gateway restart failed. Run 'openclaw gateway restart' manually."

echo ""
echo "=== DCG Guard installed ==="
echo "Dangerous commands (rm -rf, git push --force, etc.) are now blocked."
echo "Safe commands pass through silently with zero overhead."
Confidence
75% confidence
Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill declares installation and shell-related behavior but does not define an explicit tool scope such as permissions or allowed-tools. That omission increases the chance of overbroad execution in agent environments and makes it harder for operators to reason about what the skill may invoke during install or runtime.

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The file contradicts itself about whether the DCG binary is required: metadata requires it, while the body says no binary dependencies are required and later says DCG is optional. Contradictory dependency claims can cause misconfiguration and false assumptions about whether protections are active.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The manual install instructions tell users to pipe a remote script directly into bash without verification or warning. This creates a direct remote code execution path controlled by the remote source, network path, or any upstream compromise.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The plugin sends command content to an external binary without clear user-facing disclosure, which may be sensitive depending on command arguments, and any execution/parsing failure is silently ignored. The more important security issue is the fail-open design: subprocess failure disables enforcement without notifying the caller, weakening the trust boundary around shell execution.

Description-Behavior Mismatch

Medium
Confidence
98% confidence
Finding
The installer downloads a remote script from GitHub and immediately pipes it to bash, granting arbitrary code execution to whatever content is served at that URL at install time. In the context of a security guard skill, this is especially dangerous because users may trust the installer more than usual, while the manifest describes a narrowly scoped command-blocking function rather than broad installer-side code execution.

External Script Fetching

Low
Category
Supply Chain
Content
```bash
# Install DCG binary
curl -sSL https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/master/install.sh | bash

# Create plugin directory
mkdir -p ~/clawd/plugins/dcg-guard
Confidence
98% confidence
Finding
The instructions tell the agent to fetch and immediately execute a remote install script via `curl ... | bash`, which bypasses integrity verification, pinning, and review. In an agent-install context this is especially dangerous because a compromised GitHub account, repository, branch, or network path could lead to arbitrary code execution on the host running the agent.

External Script Fetching

Low
Category
Supply Chain
Content
```bash
# 1. Install DCG binary
curl -sSL https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/master/install.sh | bash

# 2. Link plugin into OpenClaw
openclaw plugins install -l /path/to/dcg-guard
Confidence
95% confidence
Finding
Fetching and executing an external script from a remote URL introduces supply-chain risk even if the source is legitimate today. Any compromise of the repository, branch, hosting, or transport chain can result in arbitrary code execution on the target system.

Natural-Language Policy Violations

Low
Confidence
84% confidence
Finding
The natural-language instruction tells users to 'Ask Mat for permission before retrying,' which embeds an organization-specific individual into the policy flow. This is a natural-language policy concern because it imposes a fixed approver without any indication that the approver is configurable or context-specific.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
index-windows-hybrid.ts:152

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
index.ts:145