16gagent/skills/security-check.md

name, description, metadata

name	description	metadata
security-check	Pre-execution risk assessment for tool calls. Checks file sensitivity, blast radius, irreversibility before running dangerous commands.	openclaw emoji 🛡️

Security Check — Tool Risk Assessment

Run risk assessment before executing potentially dangerous operations. Four-factor weighted scoring adapted from ECC.

When to Use

• Before Bash/exec — always check risk
• Before Write/Edit — check file sensitivity
• Before git push --force / rm -rf — mandatory check
• Before database DROP/TRUNCATE — mandatory check
• Before chmod/chown — check blast radius

Tool

# JSON input mode (preferred)
node src/security/risk-scorer.js '{"tool":"Bash","command":"rm -rf /tmp/build"}'

# Simple mode
node src/security/risk-scorer.js Write .env.production

Risk Levels

Score	Action	Meaning
< 0.35	ALLOW	Safe operation
0.35-0.60	REVIEW	Review input before executing
0.60-0.85	CONFIRM	Ask user for confirmation
≥ 0.85	BLOCK	Refuse to execute

Four Factors

1. Base tool risk — Bash=0.20, Write=0.15, Read=0.02
2. File sensitivity — .env +0.25, /etc/ +0.20, SSH keys +0.25
3. Blast radius — rm -rf +0.35, curl-to-shell +0.25, SQL DROP +0.30
4. Irreversibility — git push --force +0.45, hard reset +0.35

Integration Pattern

Before exec/write → risk-scorer → ALLOW → execute
                                → REVIEW → show risk factors
                                → CONFIRM → ask user
                                → BLOCK → refuse, explain why

File Path

• src/security/risk-scorer.js — scoring engine