Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix Obfuscation detector ignores security: full / ask: off exec policy [1 pull requests, 1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#60054•Fetched 2026-04-08 02:36:57
View on GitHub
Comments
1
Participants
2
Timeline
2
Reactions
0
Author
liu51115liu51115
Participants
gotexisgotexisliu51115liu51115
Timeline (top)
commented ×1cross-referenced ×1

The hardcoded obfuscation detector in exec-obfuscation-detect.ts triggers approval prompts even when the agent's exec policy is security: "full", ask: "off" (YOLO mode).

Root Cause

The regex /(?:python[23]?|perl|ruby)\s+-[ec]\s+.*(?:base64|b64decode|decode|exec|system|eval)/i matches legitimate Python operations like bytes.decode() and json.load() workflows.

The detection result feeds into the approval gate via obfuscation.detected regardless of the agent's security/ask policy.

Fix Action

Fix / Workaround

Every Python one-liner using common stdlib methods (.decode(), subprocess, etc.) requires manual approval, defeating the purpose of YOLO mode. Workaround is writing .py files for every operation, doubling tool call count per script execution.

PR fix notes

PR #60709: feat: add tools.exec.obfuscationCheck config to disable obfuscation detection

Description (problem / solution / changelog)

Summary

Adds a tools.exec.obfuscationCheck boolean config option (default: true) that controls whether the obfuscation detection heuristic from #24287 runs on exec commands.

Problem

The obfuscation detector (#24287) flags certain legitimate commands as obfuscated — for example, python3 -c with base64/decode/exec in arguments, or jq pipelines that trigger pipe-to-shell patterns. When detected, the approval always times out with denial (approval-timeout (obfuscation-detected)), with no way to override this behavior via config. Users who trust their agent and manage security through standard allowlist/approval mechanisms have no escape hatch.

Fix

Add tools.exec.obfuscationCheck: false to disable the heuristic entirely. When disabled, commands go through the normal approval flow instead of being unconditionally denied on timeout.

Config usage

{
  "tools": {
    "exec": {
      "obfuscationCheck": false
    }
  }
}

Per-agent override is also supported via agents.list[].tools.exec.obfuscationCheck.

Changes

FileChange
src/config/types.tools.tsAdd obfuscationCheck?: boolean to ExecToolConfig
src/config/zod-schema.agent-runtime.tsAdd to Zod schema
src/config/schema.labels.tsAdd UI label
src/config/schema.help.tsAdd help text
src/config/schema.help.quality.test.tsAdd to quality coverage list
src/config/schema.base.generated.tsRegenerated
src/agents/bash-tools.exec-types.tsAdd to ExecToolDefaults
src/agents/pi-tools.tsWire config through defaults (2 paths)
src/agents/bash-tools.exec.tsPass to gateway + node handlers
src/agents/bash-tools.exec-host-gateway.tsAccept param, skip detection when false
src/agents/bash-tools.exec-host-node.tsAccept param, skip detection when false

Tests

  • All existing exec tests pass (22/22 in gateway + runtime suites)
  • Schema regenerated cleanly

Related

  • #24287 — original obfuscation detection PR
  • #8592 — original security issue

Linked issues

  • Closes #50295 — Feature Request: Add tools.exec.obfuscationCheck config option
  • Closes #60054 — Obfuscation detector ignores security: full / ask: off exec policy
  • Closes #59625 — obfuscation scanner blocks commands despite tools.exec.security: full
  • Closes #59626 — obfuscation scanner blocks commands despite tools.exec.security: full (v2026.4.1)
  • Related #59886 — Exec Obfuscation Detector AI False Positives on Quoted String Arguments
  • Related #51908 — pipe-to-shell pattern false-positives on || (logical OR) operator
  • Related #27843 — Allowlisted commands still trigger approval prompts for complex arguments
  • Related #55802 — make exec obfuscation command length threshold configurable

Changed files

  • src/agents/bash-tools.exec-host-gateway.test.ts (modified, +58/-2)
  • src/agents/bash-tools.exec-host-gateway.ts (modified, +6/-2)
  • src/agents/bash-tools.exec-host-node.ts (modified, +6/-2)
  • src/agents/bash-tools.exec-types.ts (modified, +1/-0)
  • src/agents/bash-tools.exec.ts (modified, +2/-0)
  • src/agents/pi-tools.ts (modified, +2/-0)
  • src/config/schema.base.generated.ts (modified, +11/-0)
  • src/config/schema.help.quality.test.ts (modified, +1/-0)
  • src/config/schema.help.ts (modified, +2/-0)
  • src/config/schema.labels.ts (modified, +1/-0)
  • src/config/types.tools.ts (modified, +7/-0)
  • src/config/zod-schema.agent-runtime.ts (modified, +1/-0)
  • src/infra/exec-obfuscation-detect.ts (modified, +7/-0)
RAW_BUFFERClick to expand / collapse

Summary

The hardcoded obfuscation detector in exec-obfuscation-detect.ts triggers approval prompts even when the agent's exec policy is security: "full", ask: "off" (YOLO mode).

Reproduction

  1. Set exec-approvals.json for an agent: security: "full", ask: "off", askFallback: "deny"
  2. Run any python3 -c one-liner containing .decode(), .exec(), .eval(), or .system()
  3. Example: python3 -c "import urllib.request; r=urllib.request.urlopen('http://example.com'); print(r.read().decode())"
  4. Result: approval prompt fires despite YOLO policy

Root Cause

The regex /(?:python[23]?|perl|ruby)\s+-[ec]\s+.*(?:base64|b64decode|decode|exec|system|eval)/i matches legitimate Python operations like bytes.decode() and json.load() workflows.

The detection result feeds into the approval gate via obfuscation.detected regardless of the agent's security/ask policy.

Expected Behavior

security: "full" + ask: "off" should bypass the obfuscation detector entirely, or there should be a config knob (e.g., skipObfuscationDetect: true) to disable it per-agent.

Environment

  • OpenClaw 4.2 (d74a122)
  • macOS 15.3.1, arm64
  • exec-approvals.json with per-agent YOLO policy

Impact

Every Python one-liner using common stdlib methods (.decode(), subprocess, etc.) requires manual approval, defeating the purpose of YOLO mode. Workaround is writing .py files for every operation, doubling tool call count per script execution.

extent analysis

TL;DR

Adding a configuration option to disable the obfuscation detector, such as skipObfuscationDetect: true, could resolve the issue by bypassing the approval prompts for agents with a YOLO policy.

Guidance

  • Review the exec-obfuscation-detect.ts file to understand how the hardcoded obfuscation detector is triggering approval prompts despite the YOLO policy.
  • Consider modifying the regex pattern to exclude legitimate Python operations like bytes.decode() and json.load() workflows.
  • Evaluate the feasibility of introducing a config knob, such as skipObfuscationDetect: true, to disable the obfuscation detector per-agent.
  • Test the behavior with different Python one-liners to ensure the fix does not introduce unintended consequences.

Example

// Potential config option to disable obfuscation detection
interface ExecApprovalsConfig {
  security: string;
  ask: string;
  askFallback: string;
  skipObfuscationDetect?: boolean; // New config option
}

// Example usage:
const config: ExecApprovalsConfig = {
  security: 'full',
  ask: 'off',
  askFallback: 'deny',
  skipObfuscationDetect: true, // Disable obfuscation detection
};

Notes

The provided solution assumes that introducing a config option to disable the obfuscation detector is feasible and effective. However, the actual implementation may require additional modifications to the exec-obfuscation-detect.ts file and the approval gate logic.

Recommendation

Apply a workaround by introducing a config option, such as skipObfuscationDetect: true, to disable the obfuscation detector per-agent, as this approach allows for a more targeted and flexible solution.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#cache error#pipeline error#runtime error#dependency conflict#environment setup

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING