Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix Bug: obfuscation scanner blocks commands despite tools.exec.security: full [1 pull requests, 4 comments, 4 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#59625•Fetched 2026-04-08 02:42:21
View on GitHub
Comments
4
Participants
4
Timeline
5
Reactions
0
Author
lutherb4lutherb4
Participants
GMTekAIGMTekAIgotexisgotexislutherb4lutherb4mizzleclawdmizzleclawd
Timeline (top)
commented ×4cross-referenced ×1

Fix Action

Fix / Workaround

Workaround: Write scripts to local files first, then scp + execute. Functional but slower.

PR fix notes

PR #60709: feat: add tools.exec.obfuscationCheck config to disable obfuscation detection

Description (problem / solution / changelog)

Summary

Adds a tools.exec.obfuscationCheck boolean config option (default: true) that controls whether the obfuscation detection heuristic from #24287 runs on exec commands.

Problem

The obfuscation detector (#24287) flags certain legitimate commands as obfuscated — for example, python3 -c with base64/decode/exec in arguments, or jq pipelines that trigger pipe-to-shell patterns. When detected, the approval always times out with denial (approval-timeout (obfuscation-detected)), with no way to override this behavior via config. Users who trust their agent and manage security through standard allowlist/approval mechanisms have no escape hatch.

Fix

Add tools.exec.obfuscationCheck: false to disable the heuristic entirely. When disabled, commands go through the normal approval flow instead of being unconditionally denied on timeout.

Config usage

{
  "tools": {
    "exec": {
      "obfuscationCheck": false
    }
  }
}

Per-agent override is also supported via agents.list[].tools.exec.obfuscationCheck.

Changes

FileChange
src/config/types.tools.tsAdd obfuscationCheck?: boolean to ExecToolConfig
src/config/zod-schema.agent-runtime.tsAdd to Zod schema
src/config/schema.labels.tsAdd UI label
src/config/schema.help.tsAdd help text
src/config/schema.help.quality.test.tsAdd to quality coverage list
src/config/schema.base.generated.tsRegenerated
src/agents/bash-tools.exec-types.tsAdd to ExecToolDefaults
src/agents/pi-tools.tsWire config through defaults (2 paths)
src/agents/bash-tools.exec.tsPass to gateway + node handlers
src/agents/bash-tools.exec-host-gateway.tsAccept param, skip detection when false
src/agents/bash-tools.exec-host-node.tsAccept param, skip detection when false

Tests

  • All existing exec tests pass (22/22 in gateway + runtime suites)
  • Schema regenerated cleanly

Related

  • #24287 — original obfuscation detection PR
  • #8592 — original security issue

Linked issues

  • Closes #50295 — Feature Request: Add tools.exec.obfuscationCheck config option
  • Closes #60054 — Obfuscation detector ignores security: full / ask: off exec policy
  • Closes #59625 — obfuscation scanner blocks commands despite tools.exec.security: full
  • Closes #59626 — obfuscation scanner blocks commands despite tools.exec.security: full (v2026.4.1)
  • Related #59886 — Exec Obfuscation Detector AI False Positives on Quoted String Arguments
  • Related #51908 — pipe-to-shell pattern false-positives on || (logical OR) operator
  • Related #27843 — Allowlisted commands still trigger approval prompts for complex arguments
  • Related #55802 — make exec obfuscation command length threshold configurable

Changed files

  • src/agents/bash-tools.exec-host-gateway.test.ts (modified, +58/-2)
  • src/agents/bash-tools.exec-host-gateway.ts (modified, +6/-2)
  • src/agents/bash-tools.exec-host-node.ts (modified, +6/-2)
  • src/agents/bash-tools.exec-types.ts (modified, +1/-0)
  • src/agents/bash-tools.exec.ts (modified, +2/-0)
  • src/agents/pi-tools.ts (modified, +2/-0)
  • src/config/schema.base.generated.ts (modified, +11/-0)
  • src/config/schema.help.quality.test.ts (modified, +1/-0)
  • src/config/schema.help.ts (modified, +2/-0)
  • src/config/schema.labels.ts (modified, +1/-0)
  • src/config/types.tools.ts (modified, +7/-0)
  • src/config/zod-schema.agent-runtime.ts (modified, +1/-0)
  • src/infra/exec-obfuscation-detect.ts (modified, +7/-0)

Code Example

tools:
  exec:
    ask: "off"
    security: "full"

---

# Blocked: python3 inline one-liner
ssh ubuntu@host "python3 -c 'import json,time; c=json.load(open(\"/path/to/file\")); print(c[\"key\"])'"

# Blocked: heredoc inside SSH
ssh ubuntu@host "sudo tee /etc/file << 'EOF'
content
EOF"

# Blocked: variable assignment chain in multi-line SSH
cp -r /home/agent/workspace/.ssh/* ~/.ssh/ 2>/dev/null && chmod 600 ~/.ssh/*.pem 2>/dev/null
RAW_BUFFERClick to expand / collapse

Bug: obfuscation scanner blocks commands despite tools.exec.security: "full"

Version: OpenClaw 2026.4.1 (da64a97)

Config:

tools:
  exec:
    ask: "off"
    security: "full"

Expected: security: "full" bypasses the obfuscation scanner entirely — all commands run without approval.

Actual: Commands containing python3 -c '...' inline one-liners, heredocs with escaped variables inside SSH strings, and multi-line variable assignment chains are blocked with approval-timeout (obfuscation-detected) even with security: "full".

Examples that are blocked:

# Blocked: python3 inline one-liner
ssh ubuntu@host "python3 -c 'import json,time; c=json.load(open(\"/path/to/file\")); print(c[\"key\"])'"

# Blocked: heredoc inside SSH
ssh ubuntu@host "sudo tee /etc/file << 'EOF'
content
EOF"

# Blocked: variable assignment chain in multi-line SSH
cp -r /home/agent/workspace/.ssh/* ~/.ssh/ 2>/dev/null && chmod 600 ~/.ssh/*.pem 2>/dev/null

Workaround: Write scripts to local files first, then scp + execute. Functional but slower.

Notes:

  • security: "full" is documented as the most permissive setting
  • This regression was the primary motivation for 4.1 (fixing #58691 where ask: "off" was ignored in 3.31)
  • The obfuscation scanner appears to be running before the security policy check, rather than after
  • openclaw doctor shows no exec scope warnings

Environment: Docker container, Telegram channel, IT operations agent

extent analysis

TL;DR

The obfuscation scanner may need to be reconfigured or patched to respect the security: "full" setting and bypass scanning for specific commands.

Guidance

  • Verify that the tools.exec.security setting is being applied correctly by checking the OpenClaw configuration and logs.
  • Consider modifying the commands to avoid triggering the obfuscation scanner, such as by using temporary files or alternative syntax.
  • Investigate the order of operations for the obfuscation scanner and security policy check to determine if the scanner is indeed running before the policy check.
  • Review the documentation for security: "full" to ensure it is correctly understood and implemented.

Example

No code snippet is provided as the issue is more related to configuration and scanner behavior.

Notes

The current workaround of writing scripts to local files and then scp + executing may be sufficient, but it is slower and may not be ideal for all use cases. The root cause of the issue appears to be related to the order of operations for the obfuscation scanner and security policy check.

Recommendation

Apply workaround: The current workaround of writing scripts to local files and then scp + executing is functional, although slower. This approach can be used until a more permanent fix is available.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#indexing error#inference speed#output truncation#response parsing#generation error

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - ✅(Solved) Fix Bug: obfuscation scanner blocks commands despite tools.exec.security: full [1 pull requests, 4 comments, 4 participants]