A safety-first preflight guard that analyzes shell and infrastructure commands for risks, secret leakage, and destructive side effects before execution.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install command-guardian
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install command-guardian using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Command Guardian?
Command Guardian is a robust preflight safety guard designed to protect developers and DevOps teams from executing high-risk or destructive shell and infrastructure commands. By integrating this tool into your Openclaw Skills collection, you gain an intelligent analysis layer that inspects commands for obvious secret leakage, workspace boundary violations, and non-trivial side effects before they touch your system.
The skill is particularly effective for teams managing complex environments involving Docker, Kubernetes, Terraform, and various cloud providers. It acts as a safety barrier by classifying risk levels and requiring explicit confirmation for any operation that could cause data loss or security breaches, ensuring that automated agents operate within safe, predefined parameters.
Command Guardian Use Cases
- Preventing accidental data loss from destructive commands like rm -rf or docker system prune.
- Detecting and blocking the exposure of inline secrets like API keys, bearer tokens, or AWS credentials.
- Validating infrastructure changes in Kubernetes, Terraform, or cloud CLIs before deployment.
- Enforcing safer Git workflows, such as preventing forced pushes to protected main or master branches.
- Auditing complex, nested shell scripts and piped commands for hidden security risks.
How Command Guardian Works
- Normalization: The skill standardizes the provided command, current working directory, and allowed workspace roots.
- Preflight Analysis: The command is passed through the preflight script which supports direct CLI input, file input, or standard streams.
- Risk Classification: The system evaluates the command against a risk rubric, labeling it as low, medium, high, or critical based on its potential impact.
- Detailed Reporting: A report is generated detailing the risk level, the reason for the classification, suggested safer rewrites, and rollback instructions.
- Decision Gating: Based on the risk level, the skill either proceeds with the operation, suggests a safer alternative, or stops execution to require manual human approval.
Command Guardian Setup
To deploy this safety layer within your Openclaw Skills environment, ensure Python 3 is installed. You can trigger the preflight checks using several input methods:
# Direct command analysis
python scripts/preflight.py --command "rm -rf /tmp/cache" --cwd "/project" --allowed-root "/project" --format json
# Analysis from a text file
python scripts/preflight.py --command-file command.txt --cwd "/project" --allowed-root "/project" --format json
# Analysis via stdin
echo 'docker system prune' | python scripts/preflight.py --cwd "." --allowed-root "." --format json
Command Guardian Data Schema & Taxonomy
Command Guardian organizes its safety logic through a modular script architecture and markdown-based reference rules:
| Component | Function |
|---|---|
| scripts/preflight.py | The primary orchestrator that runs classification, path checks, and secret detection. |
| scripts/classify_command.py | Identifies command categories such as destructive, write-intensive, or privileged. |
| scripts/path_guard.py | Validates that file operations stay within allowed directory boundaries. |
| scripts/secret_guard.py | Scans for hardcoded patterns like JWTs, GitHub PATs, and AWS access keys. |
| scripts/rollback_hints.py | Generates recovery guidance for Git, K8s, Terraform, and Docker. |
| references/risk-rules.md | Defines the risk rubric and thresholds for automated vs. manual execution. |
Command Guardian Advanced Features
- Multi-agent support for collaborative infrastructure management and safety auditing.
- Support for complex compound commands using shell wrappers like bash -c or powershell -Command.
- Context-aware Git analysis that adjusts risk levels based on the current active branch (e.g., main vs feature).
- Automated generation of backup commands (e.g., creating a temporary git branch) before destructive operations.
- Seamless integration with standard CI/CD and terminal workflows for real-time safety feedback.
SKILL.md
Loading
Related Openclaw Skills
Feishu MCP
A sophisticated Model Context Protocol integration that enables AI agents to perform full-lifecycle document and table operations within Feishu.
Enterprise Public Opinion Monitoring (Company Information)
A powerful corporate monitoring tool that provides real-time news, sentiment analysis, and risk warnings for listed companies using the FEEDAX API.
OpenClaw Skill Testing Framework
An automated testing suite designed to validate trigger accuracy, functional correctness, and performance benchmarks for AI agent skills.
Resume-JD-Matcher
An AI-driven recruitment tool that automates the batch parsing of resumes and matches them against job descriptions to generate structured evaluation reports.
Beta Backtester
A professional quantitative backtesting framework for validating and optimizing trading strategies across stocks, crypto, and forex.
Quick Music
A zero-dependency CLI tool for instantaneous music searching and streaming link retrieval.
Featured*
