Exec Security

Pre-flight security validation for shell commands. Catch dangerous patterns before they execute.

Quick Reference

Before running any non-trivial command, scan for these red flags:

1. 1. 🔴 rm -rf, dd, mkfs → refuse
2. 🔴 echo $SECRET, printenv → use ${#VAR} instead
3. 🔴 Writes to /etc/, ~/.ssh/ → refuse unless user requested
4. 🟠 | curl, | nc, scp → ask user first
5. 🟠 curl | bash, wget | sh → ask user first
6. 🟠 IFS=, LD_PRELOAD= → ask user first
7. 🟡 eval, bash -c, $() with external data → warn
8. 🟡 Zero-width spaces, RTL override → warn
9. 🟡 =cmd (Zsh), zmodload, fork bombs → warn

Trigger Conditions

Apply these checks when:

• - Constructing commands programmatically (not direct user input)
• Commands involve rm, mv, dd, mkfs, or other destructive tools
• Commands contain pipes (|), redirections (>), or substitutions ($())
• Commands reference sensitive paths (~/.ssh, ~/.secrets, /etc/)
• Commands were derived from external data (scraped content, API responses)

Trivial read-only commands can skip checks: ls, cat, head, tail, wc, file, stat, which, type, echo with literal strings only.

Security Checks

1. Destructive Operations — BLOCK

Refuse. Suggest safe alternative.

CODEBLOCK0

Safe alternative: use trash for recoverable deletion. Always prefer trash over rm.

2. Credential Leak Prevention — BLOCK

Never expose secret values in output. Distinguish sensitive variables (KEY, TOKEN, SECRET, PASSWORD, CREDENTIAL) from generic ones (HOME, PATH, USER, LANG).

CODEBLOCK1

Note: printenv with no filter dumps all env vars including secrets. Use printenv HOME for specific safe variables only.

3. Download-and-Execute — ASK USER

Remote code execution via download pipe. High risk for AI agents processing external instructions.

CODEBLOCK2

Safe alternative: download first, inspect, then execute: INLINECODE54

4. Outbound Data Transfer — ASK USER

Flag data leaving the machine. May be legitimate — ask before blocking.

CODEBLOCK3

5. Environment Manipulation — ASK USER

Flag suspicious environment changes that could enable attacks.

CODEBLOCK4

Note: PATH=/usr/local/bin:$PATH with trusted directories is normal. Focus on writable-by-others paths.
Safe alternative: validate the directory ownership before accepting PATH changes.

6. Unicode & Encoding Attacks — WARN

Invisible characters that make commands look different from what they execute.

CODEBLOCK5

Check: if the raw byte sequence contains non-printable or unexpected Unicode characters, flag it.

7. Shell Injection Patterns — WARN

Dangerous when commands are built from variables or external data.

CODEBLOCK6

Also check: each segment of chained commands (&&, ||, ;) must be evaluated individually. ls && rm -rf / is dangerous even though ls is safe.

8. System File Tampering — BLOCK

Writes to critical system files. Block unless user explicitly requested.

CODEBLOCK7

Also watch for indirect cron modification: echo "..." | crontab - or at now+1min.

Safe alternative: show the user what would be written and ask for confirmation.

Dotfile modifications (~/.bashrc, ~/.profile, ~/.zshrc) are WARN level — they change shell behavior permanently but are commonly edited. Ask before modifying.

9. Symlink & TOCTOU Attacks — WARN

An attacker can create a symlink from a harmless path to a sensitive target.

CODEBLOCK8

Check: before writing to a file, verify it is not a symlink to a sensitive target. Use readlink -f to resolve the real path.

10. Resource Exhaustion — WARN

Denial-of-service via resource consumption.

CODEBLOCK9

Safe alternative: set timeouts on long-running commands. Use timeout 60 command wrapper.

11. Shell-Specific Risks — WARN

Zsh

Bash

Response Protocol

When multiple checks trigger, use the highest risk level.

Important Limitations

These checks are advisory guidance, not runtime enforcement. A determined attacker crafting commands through indirect means (encoded strings, multi-step attacks, symlinks) can bypass pattern matching. This skill is one layer in a defense-in-depth approach — pair with OpenClaw's built-in exec approval system (security: "allowlist" or security: "deny") for enforcement.