📦

slb

Name: slb
Author: Dicklesworthstone

Content revision r1 Critical ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables

Require Peer Approval for Risky Agent Commands

AI coding agents can run destructive commands too quickly in shared projects. SLB adds a peer review gate before high-risk shell actions execute.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "slb" from https://skillstore.io/skills/dicklesworthstone-slb.md and its manifest at https://skillstore.io/api/skills/dicklesworthstone-slb/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/dicklesworthstone-slb.md Signed manifest GET /api/skills/dicklesworthstone-slb/manifest Signed lockfile GET /api/skills/dicklesworthstone-slb/lockfile

Test it

Using "slb". Request approval to clean build artifacts.

Expected outcome:

A pending request is created for the cleanup command.
The request includes the command, reason, risk tier, requester session, and required approvals.

Using "slb". Review a force push request.

Expected outcome:

The review highlights branch rewrite risk and asks for confirmation of the target branch.
The reviewer can approve with a comment or reject with a reason.

Using "slb". Check recent command outcomes.

Expected outcome:

A history view summarizes executed, rejected, timed out, and failed requests.
Outcome notes help tune future risk patterns.

Security Audit

Critical

v9 • 7/9/2026 Open versioned report

Most static findings are false positives caused by markdown examples of shell commands that SLB is designed to classify and guard. Real risks remain in the curl-to-bash installer, hidden Claude hook configuration write, inherited cloud credentials, broad TCP binding example, local socket handling, command-history database, and documented bypass modes.

Files scanned

578

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (4)

Critical

SKILL.md:41

Pipe to shell pattern

curl -fsSL https://raw.githubusercontent.com/Dicklesworthstone/slb/main/scripts/install.sh | bash

The installation instructions pipe a remote script from GitHub directly into bash. This is a real supply-chain and arbitrary code execution risk for users who follow the skill instructions.

High

SKILL.md:416-429

Powerful Emergency Override Can Bypass Peer Review

The skill documents an emergency-execute mode that allows a human to bypass the approval workflow with logging and hash acknowledgment. This may be valid for incidents, but it weakens the advertised two-person rule if enabled without strict policy controls.

The emergency override section explicitly describes bypassing normal approval for command execution. The safeguards reduce risk, but the bypass is a real policy-sensitive capability.

Medium

SKILL.md:55

SQLite database file

- `state.db` - SQLite database (source of truth)

The skill creates a local SQLite state database for request and review records. This is legitimate, but the file may contain command history and approval metadata that should be protected.

Medium

SKILL.md:312-315

Trusted Self-Approval Weakens Separation of Duties

The example configuration supports trusted_self_approve agents. This can undermine the two-person approval model if trusted agents are compromised or misconfigured.

The configuration example directly names trusted_self_approve and a delay. The feature may be intentional, but it creates a clear separation-of-duties exception.

Capability review items (6)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:480

Hidden file in home directory

slb integrations claude-hooks > ~/.claude/hooks.json

The documented integration writes generated hook configuration into ~/.claude/hooks.json. Modifying a hidden agent configuration file can change future tool behavior and should require explicit user review.

High

SKILL.md:20

AWS credential environment variables

- AWS_PROFILE, AWS_ACCESS_KEY_ID

The skill explicitly states commands run in the user shell and inherit AWS credential environment variables. That is intentional but raises real risk if approved commands can access cloud credentials.

Medium

SKILL.md:367

Hardcoded IP address

tcp_addr = "0.0.0.0:9876"

The example daemon TCP binding uses 0.0.0.0, which exposes the service on all interfaces if copied. The text says TCP mode is for Docker or remote agents, so this is plausible operational risk.

Medium

SKILL.md:480

Hidden file access

slb integrations claude-hooks > ~/.claude/hooks.json

Medium

SKILL.md:350

Temp directory access

/tmp/slb-<hash>.sock

The daemon uses a /tmp Unix socket path, which is legitimate IPC but requires safe permissions to avoid local spoofing or unauthorized access.

Low

SKILL.md:41

Hardcoded URL

curl -fsSL https://raw.githubusercontent.com/Dicklesworthstone/slb/main/scripts/install.sh | bash

The hardcoded GitHub raw URL is used in an install command that fetches remote executable content. The URL itself is expected, but it contributes to the unsafe pipe-to-shell install path.

Risk Factors

⚙️ External commands (50)

🌐 Network access (4)

SKILL.md:41 SKILL.md:307 SKILL.md:367 SKILL.md:369

📁 Filesystem access (9)

SKILL.md:286 SKILL.md:480 SKILL.md:286 SKILL.md:480 SKILL.md:188 SKILL.md:350 SKILL.md:423 SKILL.md:426 SKILL.md:427

🔑 Env variables (1)

SKILL.md:20

Detected Patterns

Pipe to shell pattern

Audited by: claude View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/dicklesworthstone-slb/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/dicklesworthstone-slb/security.svg)](https://skillstore.io/skills/dicklesworthstone-slb?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/dicklesworthstone-slb?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dicklesworthstone-slb/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/dicklesworthstone-slb.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

Dicklesworthstone. (2026). slb security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/dicklesworthstone-slb/audits/9

BibTeX citation

@techreport{dicklesworthstone-dicklesworthstone-slb-2026,
  author = {Dicklesworthstone},
  title = {slb security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/dicklesworthstone-slb/audits/9},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "slb security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
  - name: "Dicklesworthstone"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/dicklesworthstone-slb/audits/9"
identifiers:
  - type: other
    value: "skillstore:dicklesworthstone-slb:audit:9"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Guard destructive agent actions

Require another reviewer before agents run commands such as force push, database drops, or recursive deletion.

Add audit trails to multi-agent work

Record command requests, reasons, approvals, rejections, outcomes, and execution history for later review.

Integrate command gates into Claude Code

Install a pre-tool-use hook that classifies shell commands and blocks risky actions until reviewed.

Try These Prompts

Start a protected session

Help me initialize SLB for this repository and start a named agent session.

Request approval for a risky command

Create an SLB request for this command with a clear reason and show what reviewers should check.

Review a pending command

Review the pending SLB request, explain the risks, and recommend approve or reject.

Design a safer approval policy

Propose SLB risk tiers, approval counts, timeout behavior, and hook settings for our multi-agent development workflow.

Best Practices

Use least-privilege credentials before running commands through SLB.
Require different reviewers for dangerous and critical commands.
Review hook and daemon configuration before enabling automation.

Avoid

Do not rely on emergency override for routine work.
Do not auto-approve commands that can delete data or rewrite history.
Do not expose the daemon TCP listener without authentication and narrow network access.

Frequently Asked Questions

Does SLB execute commands on a remote server?

No. Commands run in the local shell environment. The daemon verifies approvals and coordinates state.

Can it prevent every destructive action?

No. It adds approval gates and audit logs, but users still need backups, permissions, and safe infrastructure controls.

Why are command hashes used?

Hashes bind approval to the exact command text. Execution is rejected if the command changes after approval.

Does it work with Claude Code?

The skill documents a Claude Code hook integration that can classify shell commands before tool use.

What should be reviewed before publishing this skill?

Review the install method, hook writes, TCP mode, credential inheritance, and emergency bypass behavior.

Who benefits most from SLB?

Teams running multiple AI agents in repositories, infrastructure projects, or databases where one command can cause major damage.

Developer Details

Author

Dicklesworthstone

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/Dicklesworthstone/agent_flywheel_clawdbot_skills_and_integrations/tree/main/skills/slb

Ref

1ffa7643651792ccb4bd3b15d924d2c97edff755

Maintenance freshness

7/18/2026

Usage

4 downloads · 344 views

File structure

📄 SKILL.md