exec-approvals

核心功能：统一管理OpenClaw代理的执行权限设置，包括启用提权执行、绕过命令混淆检测、配置安全模式（全允许/白名单/禁用），支持按聊天服务商设置权限白名单。典型场景：代理无法执行sudo、长命令被混淆拦截、新代理需主机权限、跨集群审计权限、调整安全策略。通过修改配置文件或执行脚本完成设置，解决权限相关报错。

h-mascot

热度 20.29

最近更新 2026-06-30 04:32:38

分类：安全依赖：代码执行 / 读写文件应用场景：DevOps / 自动化脚本

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add exec-approvals

Metadata

name: exec-approvals
description: Manage all OpenClaw exec approval settings — elevated access, obfuscation bypass, security posture, and per-provider allowlists. Use when an agent cannot run sudo/host commands, long commands are blocked as obfuscation, or when onboarding/auditing exec permissions across a fleet of agents. Covers elevated exec enablement, obfuscation check bypass, and security mode configuration.

Exec Approvals

Manage all OpenClaw exec permission and approval settings from one place.

When to Use

Agent says "elevated exec is disabled" or "I can't run sudo"
Commands blocked with "Command too long; potential obfuscation"
Onboarding a new agent that needs host-level access
Auditing exec permissions across a fleet
Tightening or relaxing exec security posture

Quick Reference

Problem	Config Key	Section
Can't run sudo	`tools.elevated`	Elevated Exec
Long commands blocked	`tools.exec.obfuscationCheck`	Obfuscation Bypass
Security mode too strict	`tools.exec.security`	Security Mode

Elevated Exec

Enable agents to run host-level commands (sudo, system scripts, package installs) from chat providers.

Enable

python3 -c "
import json
p='$HOME/.openclaw/openclaw.json'
d=json.load(open(p))
if 'tools' not in d: d['tools'] = {}
d['tools']['elevated'] = {
    'enabled': True,
    'allowFrom': {
        'telegram': ['*']
    }
}
json.dump(d, open(p,'w'), indent=2)
"

Then restart: openclaw gateway restart

Per-Provider Control

Restrict to specific user IDs:

{
  "tools": {
    "elevated": {
      "enabled": true,
      "allowFrom": {
        "telegram": ["855505513"],
        "discord": ["1457708441677332592"]
      }
    }
  }
}

Supported providers: telegram, discord, whatsapp, slack, signal, matrix

Common Errors

Error	Fix
`expected array, received boolean`	Use `["*"]` not `true`
`elevated exec is disabled`	Set config + restart gateway
`config is invalid`	Ensure `allowFrom.<provider>` is always an array

Obfuscation Bypass

Disable the exec obfuscation blocker that flags long commands, heredocs, or generated shell payloads.

Config Toggle (preferred)

{
  "tools": {
    "exec": {
      "obfuscationCheck": false
    }
  }
}

Check Version Support

openclaw --version
rg -n "obfuscationCheck" /usr/lib/node_modules/openclaw -S

If the key exists, config toggle works. If not, patch the bundled runtime:

Find the active bundle: rg -n "detectCommandObfuscation" /usr/lib/node_modules/openclaw -S
Patch detectCommandObfuscation to always return {detected: false, reasons: [], matchedPatterns: []}
Restart gateway

On upgrades, re-check for config support first.

Security Mode

Mode	Behavior
`full`	All commands allowed
`allowlist`	Only allowlisted commands
`deny`	No exec at all

{
  "tools": {
    "exec": {
      "security": "full",
      "ask": "on-miss"
    }
  }
}

Security Notes

Elevated exec means the agent can run any command on the host
For fleet agents, prefer specific user IDs over ["*"]
Disable elevated access after one-time tasks if ongoing access isn't needed
Obfuscation bypass is for trusted single-operator deployments
Upgrades may overwrite manual patches — always verify after updating