Sop Architect

Automatically generates detailed Standard Operating Procedures (SOPs) for recurring digital tasks. Ideal for scaling agency operations or documenting interna...

This skill appears to do what it says: it generates SOP markdown files and contains a small bash helper. No network calls or credentials are requested. Before installing, consider: 1) review or sanitize task names you pass to avoid accidental path traversal or file overwrite (the script does not sanitize '..' segments); 2) run the skill from a safe working directory or container so file writes cannot overwrite important files; 3) if you expect to use untrusted input for task names, modify the script to reject or sanitize non-alphanumeric characters. Otherwise the skill is coherent and low-risk.

Type: OpenClaw Skill Name: sop-architect Version: 1.1.0 The `scripts/generate_sop.sh` file contains a shell injection vulnerability. The unquoted use of `$TASK_NAME` in the `echo "# SOP: $TASK_NAME" > "$FILE"` command allows for command substitution. If the `TASK_NAME` argument (derived from user input by the agent) contains constructs like `$(command)`, the embedded command will be executed, posing a remote code execution risk. This is a vulnerability that allows attacks, classifying it as suspicious rather than malicious due to the lack of clear intent for self-exploitation or other harmful actions within the skill's design.