Shell Safe Exec

Safely run project-local build, test, lint, format, type-check, and install commands with strict restrictions to prevent destructive or system-wide effects.

This skill is internally consistent and lightweight, but it is instruction-only — its safety guarantees depend on the agent and host sandbox actually enforcing the rules. Before using: (1) Confirm the agent runtime enforces workspace isolation and cannot access files outside the repo or escalate privileges. (2) Be cautious when installing dependencies: package registries and package install scripts can execute arbitrary code (supply-chain risk). (3) Prefer invoking this skill with explicit, pinned commands rather than open-ended requests (avoid "run whatever tests are needed"). (4) Do not provide secrets or sensitive host config in the workspace. (5) If possible, run first on a disposable/CI container to validate behavior and logs.

Type: OpenClaw Skill Name: shell-safe-exec Version: 0.1.0 The skill bundle 'shell-safe-exec' provides defensive instructions for an AI agent to perform project-related shell tasks like building, testing, and linting. The instructions in SKILL.md and agents/openai.yaml explicitly forbid destructive operations, privilege escalation, and network scanning, while emphasizing the need to treat user input as untrusted to prevent command injection. No malicious code, exfiltration logic, or suspicious behaviors were identified.