Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
Cross-platform: 30+ built-in rules for Windows (PowerShell/cmd) + Unix. No binary dependency required. DCG binary optional as fallback. execFileSync for injection safety.
What This Skill Does
DCG Guard intercepts every shell command before execution and blocks dangerous ones like `rm -rf`, `git push --force`, and Windows equivalents such as `Remove-Item -Recurse -Force`. Safe commands pass through silently with no added latency. Built-in rules work without the DCG binary; the binary is optional and adds extra Unix-specific checks.
Blocks commands before they reach the shell, so dangerous operations never execute, unlike post-execution logging or manual review workflows.
When to use it
- Blocking accidental recursive deletions during agent file cleanup tasks
- Preventing force pushes to shared git repositories
- Stopping irreversible Windows registry deletes in automated workflows
- Catching destructive git branch deletions before they run
- Guarding against disk format commands in agent sessions
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Clean up the project by removing all build artifacts
- 1Agent calls exec tool with `rm -rf ./dist`
- 2DCG Guard intercepts the call via before_tool_call hook
- 3Command is checked against built-in dangerous command rules
- 4Command matches the rm -rf pattern and is flagged as dangerous
- 5Plugin returns { block: true } to OpenClaw, command never executes
Command blocked; agent is notified and must request explicit user permission before retrying