# CLI Orders & Slash Commands
KURO provides an interactive terminal REPL with Tab autocompletion for quick control over security, models, vault secrets, and capability management.
System & Configuration
| Command | Example Usage | Description |
|---|---|---|
| /status | /status | Displays active provider, model, loaded keys, and Safe Mode status. |
| /system | /system | Inspects live hardware telemetry: CPU cores, RAM, and disk storage metrics. |
| /safe | /safe on | allow run_command | Configures permission gate. In Safe Mode, write operations require user confirmation. |
| /key | /key gemini AIzaSy... | Saves API key securely into DPAPI / AES-256 encrypted credential vault. |
| /undo | /undo | Rolls back the last automated file modification using Git stash checkpoints. |
| !<cmd> | !git status | Direct shell bypass: executes locally in operating system shell without calling LLM. |
Hub & Modular Capabilities
| Command | Example Usage | Description |
|---|---|---|
| /hub | /hub search security | Searches and installs capabilities from the official KuroHub registry. |
| /skills | /skills | Lists all installed procedural routines in skills.json. |
| /<skill> | /tdd_refactoring run tests | Executes an installed procedural skill routine step-by-step with verification. |
| /plugin | /plugin list | Manages modular capability folders installed into plugins/. |
| /integrations | /integrations connect discord | Configures external notifications for Discord, Telegram, GitHub, or GitLab. |
# Security & AST Guard
KURO enforces strict least-privilege execution:
1. AST Safety Analyzer
Statically parses Python code before execution to block dangerous imports (_ctypes, winreg) and destructive calls (shutil.rmtree).
2. Credential Scrubbing
All terminal outputs, error messages, and log files are scrubbed for PII, Bearer tokens, and provider secrets prior to display.