---
name: security-check
description: Pre-execution risk assessment for tool calls. Checks file sensitivity, blast radius, irreversibility before running dangerous commands.
metadata: { "openclaw": { "emoji": "🛡️" } }
---

# Security Check — Tool Risk Assessment

Run risk assessment before executing potentially dangerous operations. Four-factor weighted scoring adapted from ECC.

## When to Use

- **Before Bash/exec** — always check risk
- **Before Write/Edit** — check file sensitivity
- **Before git push --force / rm -rf** — mandatory check
- **Before database DROP/TRUNCATE** — mandatory check
- **Before chmod/chown** — check blast radius

## Tool

```bash
# JSON input mode (preferred)
node src/security/risk-scorer.js '{"tool":"Bash","command":"rm -rf /tmp/build"}'

# Simple mode
node src/security/risk-scorer.js Write .env.production
```

## Risk Levels

| Score | Action | Meaning |
|:-----:|:------:|---------|
| < 0.35 | **ALLOW** | Safe operation |
| 0.35-0.60 | **REVIEW** | Review input before executing |
| 0.60-0.85 | **CONFIRM** | Ask user for confirmation |
| ≥ 0.85 | **BLOCK** | Refuse to execute |

## Four Factors

1. **Base tool risk** — Bash=0.20, Write=0.15, Read=0.02
2. **File sensitivity** — .env +0.25, /etc/ +0.20, SSH keys +0.25
3. **Blast radius** — rm -rf +0.35, curl-to-shell +0.25, SQL DROP +0.30
4. **Irreversibility** — git push --force +0.45, hard reset +0.35

## Integration Pattern

```
Before exec/write → risk-scorer → ALLOW → execute
                                → REVIEW → show risk factors
                                → CONFIRM → ask user
                                → BLOCK → refuse, explain why
```

## File Path

- `src/security/risk-scorer.js` — scoring engine