Sm Saver

Save and digest resources from social media posts (X/Twitter, LinkedIn) or any URL. Use when the user shares a tweet URL, a LinkedIn post, or any link they w...

This skill mostly does what it says (extracts links, fetches them, summarizes, and appends to a resources.md file), but before installing or running it consider: 1) Confirm the host environment has the expected tools: xurl, python3, and whatever 'summarize' CLI is intended — ask the skill author which 'summarize' binary/service is required. 2) Be aware the skill will fetch arbitrary URLs you supply (or that someone supplies) and could contact internal network addresses — avoid giving it untrusted or internal links, or run it in a sandbox. 3) It will write to ~/workspace/resources.md; ensure you’re comfortable with automated writes to that path. 4) Verify the provenance/trustworthiness of xurl and the summarizer (is summarization done locally or by a remote API that could receive fetched content?). If you need stronger assurance, request the skill author to: declare python3 and summarize in requires.bins, document the summarize implementation, limit or validate which URLs are fetched, and make the output file path configurable instead of hardcoded.

Type: OpenClaw Skill Name: sm-saver Version: 0.0.0-pr-check The skill bundle contains a significant command injection vulnerability in SKILL.md. It instructs the agent to execute shell commands and a Python one-liner where user-provided URLs are directly interpolated into the execution string (e.g., `summarize "<url>"` and `urllib.request.Request('<url>', ...)`). While the stated purpose of saving social media resources is plausible, the lack of input sanitization in these `exec` calls allows a crafted URL to execute arbitrary code on the host system. No evidence of intentional malice or data exfiltration was found, but the implementation is highly insecure.