RegexTester

正则表达式助手，支持匹配测试、提取所有匹配、分组捕获、文本替换及常用模式生成。

This skill is coherent and appears to do only local regex processing. Things to consider before installing: (1) The tool processes text you pass to it—avoid feeding secrets or sensitive files unless you trust the runtime and local environment. Examples in SKILL.md that use shell substitution (e.g., $(cat error.log)) will cause the shell to read files on disk before invoking the script. (2) As with any regex tool, untrusted or pathological regular expressions can be CPU-intensive (ReDoS) if run against large inputs—avoid running untrusted complex patterns on very large files. (3) If you need network isolation or extra confidentiality, run the script in an isolated environment. Otherwise, the skill does not request credentials or perform network access and is internally consistent with its description.

Type: OpenClaw Skill Name: regex-tester Version: 1.0.0 The Python script (`script/main.py`) itself is benign, using standard `re` module functions without any dangerous system calls, network activity, or file manipulation beyond its stated purpose. However, the `SKILL.md` documentation contains an example (`python3 script/main.py findall "ERROR:\s*(\w+)" "$(cat error.log)"`) that demonstrates shell command substitution. If an AI agent executes this instruction directly in a shell environment, it presents a shell injection vulnerability, allowing arbitrary commands to be executed via the `$(...)` construct. This is a risky capability, even if the developer's intent was to show how to pass file content, and thus classifies the skill as suspicious.