Quick Test

Run basic system commands to verify Python, working directory, file access, and command execution for OpenClaw environment validation and debugging.

This appears to be a simple environment-check tool but it has mismatches and risky patterns. Before running it: (1) Review the Python script locally — do not run it in a production account or with sensitive environment variables present. (2) Fix or inspect subprocess usage: either use subprocess.run([...], shell=False) with argument lists or pass a single shell string if you intentionally want shell parsing; avoid shell=True if you accept untrusted input. (3) Remove or be careful with commands that print environment variables or list home directories if secrets may be present. (4) Be aware the SKILL.md promises CLI options and extra scripts that are not included; expect the shipped script to be buggy. Recommended safe approach: run inside an isolated container or ephemeral VM, or open and run the script line-by-line to confirm behavior rather than executing it untrusted. If you need this functionality but want safer behavior, ask the author to: implement proper CLI parsing, avoid shell=True, remove hard-coded paths, and limit env output to non-sensitive keys.

Type: OpenClaw Skill Name: quick-test Version: 1.0.0 This skill is classified as suspicious due to multiple vulnerabilities and risky capabilities. The `SKILL.md` explicitly instructs the OpenClaw agent to allow arbitrary command execution via a `--command` parameter, which is a severe prompt injection vulnerability. It also instructs the agent to run `env | head -10` for debugging, and the `scripts/run_tests.py` script hardcodes `env head -5` as a test, both exposing environment variables. Furthermore, the `scripts/run_tests.py` uses `subprocess.run(cmd, shell=True, ...)` which is a critical shell injection vulnerability if user input were passed to it, even though the current script does not parse the `--command` argument.