Move whitelisted commands to config.yml, make them actually work