exec-risklisted

# Exec risk (layered) — option A protocol OpenClaw `exec.mode=full` does **not** hard-block host shell. **You** enforce this skill on every host command. Skipping the gate is a protocol violation. ## Platform vs classifier (division of labor) | Layer | Local setting | Role | | --- | --- | --- | | OpenClaw host policy | `mode=full`, `ask=off` | No `/approve` spam for normal shell | | OpenClaw `strictInlineEval` | **`false`** (personal OpenClaw · Dex) | Do **not** hard-block `xargs` / `-c` at platform | | **This skill** (`claw-run` / gate) | always | Semantic risk: rules → Grok → **飞书** if danger | `strictInlineEval=false` does **not** disable the classifier. It only removes platform `/approve` on inline carriers. Risk control is **claw-run + Feishu**. Prefer: `rg -l 'pat' packages` over `find … \| xargs rg`. Classifier soft-covers high-risk inline forms (`python -c`, `xargs rm/sh`, …); innocent `xargs rg` is not auto-danger — still run via `claw-run`. ## Required entry **Prefer** `claw-run.sh` (gate + run in one step): ```bash # From repo root, or use absolute path under wezterm-config/openclaw/scripts/ ./openclaw/scripts/claw-run.sh -- git status ./openclaw/scripts/claw-run.sh 'ls -la' ./openclaw/scripts/claw-run.sh --dry-run 'rm -rf /tmp/x' # classify only ``` Gate-only (inspect without running): ```bash ./openclaw/scripts/claw-exec-gate.sh '<command>' ``` | exit | meaning | | --- | --- | | 0 | allow (or command finished after allow) | | 2 | `human_required` —