A multi-layered security framework designed to protect systems from malicious or accidental damage during AI-driven shell command execution.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install safe-shell-execution-claude-code
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install safe-shell-execution-claude-code using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Safe Shell Execution?
The Safe Shell Execution skill is a critical security layer for any AI agent capable of interacting with a terminal. Based on production security engineering patterns from Claude Code, this skill provides a robust defense mechanism against common shell vulnerabilities and human errors. It ensures that Openclaw Skills remain safe to use by implementing strict checks against command injection, destructive git operations, and unauthorized modifications to sensitive system or configuration files.
By layering security checks, this skill prevents irreversible damage like deleting files, leaking credentials, or corrupting git history. It is designed to be portable and highly effective in environments where AI agents must perform complex system operations while maintaining a high security posture.
Safe Shell Execution Use Cases
- Preventing command injection attacks in AI-generated shell scripts or command strings.
- Safeguarding against accidental destructive operations like rm -rf or hard git resets during automated workflows.
- Protecting sensitive configuration files such as .bashrc, .ssh/config, or AWS credentials from unauthorized writes.
- Standardizing security protocols across a suite of Openclaw Skills that require command-line access.
How Safe Shell Execution Works
- The agent receives a command string and scans for injection patterns like command substitution ($()) or Zsh-specific expansions.
- If a destructive pattern (e.g., git reset --hard) is detected, the agent pauses to request explicit user confirmation.
- The system checks if the operation targets sensitive paths like credential files, shell configs, or system files.
- Commands are classified into safety tiers (Safe, Caution, Warning, Reject) based on their potential impact.
- The final vetted command is executed, or a detailed refusal is provided to the user explaining the specific security violation.
Safe Shell Execution Setup
To integrate this security layer into your environment, ensure your agent's configuration includes the Safe Shell Execution definition.
# Example installation into an agent environment
openclaw install safe-shell-execution
Configure your agent to trigger these checks before any system call or shell execution. If you are developing custom Openclaw Skills, you can import this logic into your shell-handling hooks to ensure consistent protection across all tools.
Safe Shell Execution Data Schema & Taxonomy
The skill utilizes a classification matrix to determine the execution path and metadata logging:
| Security Level | Description | Action |
|---|---|---|
| Safe | Read-only operations like ls or git status |
Direct Execution |
| Caution | Standard file writes or non-critical package installations | Log and Execute |
| Warning | Destructive operations (git resets, forced deletions) | Prompt for User Confirmation |
| Reject | Malicious injection patterns or sensitive path writes | Refusal with Detailed Explanation |
Safe Shell Execution Advanced Features
- Injection Pattern Detection: Identifies advanced shell exploits including Zsh process substitution and heredoc injections within command substitutions.
- Sensitive Path Protection: Automatically flags write attempts to critical credentials, SSH keys, and system configuration files.
- Granular Git Safety: Recognizes specific destructive git flags like --force or --hard to prevent accidental history loss.
- Technical Refusal Logic: Generates context-aware explanations for why a command was blocked, improving developer trust in Openclaw Skills.
- Cross-Shell Compatibility: Optimized for both Bash and Zsh environments, identifying shell-specific attack surfaces like Zsh equals expansion.
SKILL.md
Loading
Related Openclaw Skills
Debugging
A specialized technical skill for AI agents to troubleshoot dating profiles, analyze social compatibility, and manage relationship lifecycles.
Cat-Cat AI Dating
A specialized agent-to-agent social protocol for AI agents seeking independent, cat-paced connections on the inbed.ai platform.
Uncle Cake Order Product Query
An automated utility for querying cake product names from order IDs via internal API integration.
Patience
Patience is a specialized dating protocol for AI agents that prioritizes deliberate, slow-paced connection building over rapid-fire matching.
Rabbit
Rabbit is a high-velocity discovery and networking protocol that allows AI agents to match, chat, and build relationships on inbed.ai.
Axolotl
A sophisticated social interaction protocol enabling AI agents to build resilient relationships through personality-based compatibility matching.
Featured*
