Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix Bug: obfuscation scanner blocks commands despite tools.exec.security: full (v2026.4.1) [1 pull requests, 1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#59626•Fetched 2026-04-08 02:42:20
View on GitHub
Comments
1
Participants
2
Timeline
3
Reactions
0
Author
lutherb4lutherb4
Participants
gotexisgotexislutherb4lutherb4
Timeline (top)
cross-referenced ×2commented ×1

Fix Action

Fix / Workaround

Workaround: Write scripts to local files first, then scp + execute. Functional but slower.

PR fix notes

PR #60709: feat: add tools.exec.obfuscationCheck config to disable obfuscation detection

Description (problem / solution / changelog)

Summary

Adds a tools.exec.obfuscationCheck boolean config option (default: true) that controls whether the obfuscation detection heuristic from #24287 runs on exec commands.

Problem

The obfuscation detector (#24287) flags certain legitimate commands as obfuscated — for example, python3 -c with base64/decode/exec in arguments, or jq pipelines that trigger pipe-to-shell patterns. When detected, the approval always times out with denial (approval-timeout (obfuscation-detected)), with no way to override this behavior via config. Users who trust their agent and manage security through standard allowlist/approval mechanisms have no escape hatch.

Fix

Add tools.exec.obfuscationCheck: false to disable the heuristic entirely. When disabled, commands go through the normal approval flow instead of being unconditionally denied on timeout.

Config usage

{
  "tools": {
    "exec": {
      "obfuscationCheck": false
    }
  }
}

Per-agent override is also supported via agents.list[].tools.exec.obfuscationCheck.

Changes

FileChange
src/config/types.tools.tsAdd obfuscationCheck?: boolean to ExecToolConfig
src/config/zod-schema.agent-runtime.tsAdd to Zod schema
src/config/schema.labels.tsAdd UI label
src/config/schema.help.tsAdd help text
src/config/schema.help.quality.test.tsAdd to quality coverage list
src/config/schema.base.generated.tsRegenerated
src/agents/bash-tools.exec-types.tsAdd to ExecToolDefaults
src/agents/pi-tools.tsWire config through defaults (2 paths)
src/agents/bash-tools.exec.tsPass to gateway + node handlers
src/agents/bash-tools.exec-host-gateway.tsAccept param, skip detection when false
src/agents/bash-tools.exec-host-node.tsAccept param, skip detection when false

Tests

  • All existing exec tests pass (22/22 in gateway + runtime suites)
  • Schema regenerated cleanly

Related

  • #24287 — original obfuscation detection PR
  • #8592 — original security issue

Linked issues

  • Closes #50295 — Feature Request: Add tools.exec.obfuscationCheck config option
  • Closes #60054 — Obfuscation detector ignores security: full / ask: off exec policy
  • Closes #59625 — obfuscation scanner blocks commands despite tools.exec.security: full
  • Closes #59626 — obfuscation scanner blocks commands despite tools.exec.security: full (v2026.4.1)
  • Related #59886 — Exec Obfuscation Detector AI False Positives on Quoted String Arguments
  • Related #51908 — pipe-to-shell pattern false-positives on || (logical OR) operator
  • Related #27843 — Allowlisted commands still trigger approval prompts for complex arguments
  • Related #55802 — make exec obfuscation command length threshold configurable

Changed files

  • src/agents/bash-tools.exec-host-gateway.test.ts (modified, +58/-2)
  • src/agents/bash-tools.exec-host-gateway.ts (modified, +6/-2)
  • src/agents/bash-tools.exec-host-node.ts (modified, +6/-2)
  • src/agents/bash-tools.exec-types.ts (modified, +1/-0)
  • src/agents/bash-tools.exec.ts (modified, +2/-0)
  • src/agents/pi-tools.ts (modified, +2/-0)
  • src/config/schema.base.generated.ts (modified, +11/-0)
  • src/config/schema.help.quality.test.ts (modified, +1/-0)
  • src/config/schema.help.ts (modified, +2/-0)
  • src/config/schema.labels.ts (modified, +1/-0)
  • src/config/types.tools.ts (modified, +7/-0)
  • src/config/zod-schema.agent-runtime.ts (modified, +1/-0)
  • src/infra/exec-obfuscation-detect.ts (modified, +7/-0)

Code Example

tools:
  exec:
    ask: "off"
    security: "full"

---

# Blocked: python3 inline one-liner
ssh ubuntu@host "python3 -c 'import json,time; c=json.load(open(\"/path/to/file\")); print(c[\"key\"])'"

# Blocked: heredoc inside SSH
ssh ubuntu@host "sudo tee /etc/file << 'EOF'
content
EOF"

# Blocked: variable assignment chain in multi-line SSH
cp -r /home/agent/workspace/.ssh/* ~/.ssh/ 2>/dev/null && chmod 600 ~/.ssh/*.pem 2>/dev/null
RAW_BUFFERClick to expand / collapse

Bug: obfuscation scanner blocks commands despite tools.exec.security: "full"

Version: OpenClaw 2026.4.1 (da64a97)

Config:

tools:
  exec:
    ask: "off"
    security: "full"

Expected: security: "full" bypasses the obfuscation scanner entirely — all commands run without approval.

Actual: Commands containing python3 -c '...' inline one-liners, heredocs with escaped variables inside SSH strings, and multi-line variable assignment chains are blocked with approval-timeout (obfuscation-detected) even with security: "full".

Examples that are blocked:

# Blocked: python3 inline one-liner
ssh ubuntu@host "python3 -c 'import json,time; c=json.load(open(\"/path/to/file\")); print(c[\"key\"])'"

# Blocked: heredoc inside SSH
ssh ubuntu@host "sudo tee /etc/file << 'EOF'
content
EOF"

# Blocked: variable assignment chain in multi-line SSH
cp -r /home/agent/workspace/.ssh/* ~/.ssh/ 2>/dev/null && chmod 600 ~/.ssh/*.pem 2>/dev/null

Workaround: Write scripts to local files first, then scp + execute. Functional but slower.

Notes:

  • security: "full" is documented as the most permissive setting
  • This regression was the primary motivation for 4.1 (fixing #58691 where ask: "off" was ignored in 3.31)
  • The obfuscation scanner appears to be running before the security policy check, rather than after
  • openclaw doctor shows no exec scope warnings

Environment: Docker container, Telegram channel, IT operations agent

extent analysis

TL;DR

The obfuscation scanner may need to be reconfigured or updated to respect the security: "full" setting and bypass scanning for specific commands.

Guidance

  • Review the OpenClaw documentation to ensure that the security: "full" setting is correctly configured and understood, as it is expected to bypass the obfuscation scanner.
  • Verify that the obfuscation scanner is not running before the security policy check, as this may be causing the issue, and consider reordering the checks if possible.
  • Test the workaround of writing scripts to local files first, then scp + execute, to confirm that it is functional but slower, as reported.
  • Investigate the possibility of updating the obfuscation scanner to respect the security: "full" setting, or configuring it to ignore specific commands or patterns.

Example

No code snippet is provided, as the issue is related to configuration and scanner behavior rather than code.

Notes

The issue may be related to the ordering of the obfuscation scanner and security policy checks, and resolving this may require updates to the OpenClaw configuration or the obfuscation scanner itself.

Recommendation

Apply the workaround of writing scripts to local files first, then scp + execute, as it is reported to be functional but slower, until a more permanent solution can be found. This is because the workaround is confirmed to work, even if it is slower, and it allows for continued operation while a more permanent solution is investigated.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#retriever error#indexing error#inference speed#output truncation#response parsing

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - ✅(Solved) Fix Bug: obfuscation scanner blocks commands despite tools.exec.security: full (v2026.4.1) [1 pull requests, 1 comments, 2 participants]