2491f5c732
40 files demonstrating every major OpenClaw capability using Claude Code: - 3 agents (researcher, writer, reviewer) - 3 skills (daily-briefing, slack-message, web-research) - 2 security hooks (pre-tool-use blocker, post-tool-use logger) - 10 self-contained examples with copy-paste prompts - Complete feature map (20 capabilities, 11 full match, 7 different, 2 gap) - Security docs including NemoClaw comparison - Automation, messaging, browser, memory documentation Zero dependencies. Clone and run. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
53 lines
1.4 KiB
Bash
Executable file
53 lines
1.4 KiB
Bash
Executable file
#!/bin/bash
|
|
# PreToolUse hook: Block dangerous shell commands before execution.
|
|
#
|
|
# This hook reads the tool input from stdin (JSON with tool_name and tool_input)
|
|
# and blocks commands that could cause serious damage.
|
|
#
|
|
# How it works:
|
|
# - Claude Code calls this script BEFORE executing any Bash command
|
|
# - If the script exits with code 2, the command is BLOCKED
|
|
# - The "decision" field in stdout JSON controls the outcome
|
|
#
|
|
# OpenClaw equivalent: exec approvals + tool deny lists + Docker sandbox
|
|
# Claude Code approach: hook-based guardrails (more flexible, user-controlled)
|
|
|
|
input=$(cat)
|
|
tool_name=$(echo "$input" | python3 -c "import sys,json; print(json.load(sys.stdin).get('tool_name',''))" 2>/dev/null)
|
|
command=$(echo "$input" | python3 -c "import sys,json; print(json.load(sys.stdin).get('tool_input',{}).get('command',''))" 2>/dev/null)
|
|
|
|
# Only check Bash commands
|
|
if [ "$tool_name" != "Bash" ]; then
|
|
exit 0
|
|
fi
|
|
|
|
# Blocked patterns
|
|
blocked_patterns=(
|
|
"rm -rf /"
|
|
"rm -rf ~"
|
|
"rm -rf \$HOME"
|
|
"mkfs"
|
|
"dd if="
|
|
":(){:|:&};:"
|
|
"chmod -R 777 /"
|
|
"curl.*|.*bash"
|
|
"wget.*|.*bash"
|
|
"curl.*|.*sh"
|
|
"wget.*|.*sh"
|
|
"> /dev/sda"
|
|
"sudo rm"
|
|
"shutdown"
|
|
"reboot"
|
|
"init 0"
|
|
"init 6"
|
|
)
|
|
|
|
for pattern in "${blocked_patterns[@]}"; do
|
|
if echo "$command" | grep -qi "$pattern"; then
|
|
echo '{"decision": "block", "reason": "Blocked by security hook: command matches dangerous pattern '"'$pattern'"'"}'
|
|
exit 2
|
|
fi
|
|
done
|
|
|
|
# Allow everything else
|
|
exit 0
|