cmd-guard命令安全守卫。在执行 shell 命令前进行语义分类(READ/WRITE/NETWORK/DESTRUCTIVE),自动放行安全操作,拦截危险操作。灵感来自 Claude Code 的命令语义分类器。触发词:exec guard、命令安全、安全执行、safe exec。
Install via ClawdBot CLI:
clawdbot install wavmson/cmd-guardGrade Fair — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Potentially destructive shell commands in tool definitions
rm -rf /Uses known external API (expected, informational)
api.openai.comAudited Apr 17, 2026 · audit v1.0
Generated May 21, 2026
In a continuous integration/development pipeline, exec guard classifies shell commands as read or write to the workspace, auto-allowing safe commands like git status, while requiring confirmation for destructive operations like git reset --hard, preventing accidental data loss.
DevOps teams managing cloud servers can use exec guard to allow system-level writes like apt install only after confirmation, while auto-allowing read-only commands like docker ps. This reduces risk of misconfigurations during routine maintenance.
Data scientists installing packages like pip install or modifying configuration files can benefit from exec guard's NETWORK classification, which auto-allows GET requests to known safe domains and prompts for other network operations, balancing convenience and security.
Online coding platforms for students can use exec guard to enforce strict security: auto-allowing read commands and workspace writes, but blocking destructive commands like rm -rf, ensuring a safe learning environment without exposing the underlying system.
Web hosting providers managing customer servers can deploy exec guard to allow routine operations like file transfers and log reads automatically, while requiring confirmation for high-risk actions like systemctl operations, reducing support tickets and security incidents.
Offer a basic version of exec guard as a free plugin for open-source AI agent platforms, with premium features like custom white-labeling and advanced policy configurations available via subscription.
Provide consulting services to enterprises integrating exec guard into their custom AI agent workflows, including rule customization, audit logging, and employee training.
Sell enterprise licenses that include exec guard plus compliance reporting, SOC 2/ISO 27001 alignment, and integration with existing security information and event management systems.
💬 Integration Tip
Add exec guard as a plugin to your AI agent and enable 'security: full' mode for maximum protection. Customize the safe domain white list and user preference memory file for your environment.
Scored May 21, 2026
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope,...
Comprehensive security auditing for Clawdbot deployments. Scans for exposed credentials, open ports, weak configs, and vulnerabilities. Auto-fix mode included.
Analyze and classify agent skills for safety using local evaluation. Optionally produce a signed attestation of the vetting result.
Detect 500+ types of hardcoded secrets (API keys, credentials, tokens) before they leak into git. Wraps GitGuardian's ggshield CLI.
Audit codebases and infrastructure for security issues. Use when scanning dependencies for vulnerabilities, detecting hardcoded secrets, checking OWASP top 10 issues, verifying SSL/TLS, auditing file permissions, or reviewing code for injection and auth flaws.
Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.