Terminal Killer

Intelligent shell command detector and executor for OpenClaw. Automatically identifies terminal commands (system builtins, $PATH executables, history matches...

This skill does what it says — it will detect and run shell commands using your real shell environment. That requires sourcing your dotfiles (~/.zshrc, ~/.bashrc) and reading shell history; both are legitimate for this task but are risky because dotfiles can run arbitrary code and history or command outputs may contain secrets (API keys, tokens, passwords). Before installing or enabling: 1) Review the source (you have it) and confirm you trust the author; 2) Inspect your shell init files for unexpected network calls or side effects (and consider running the skill under a sanitized shell or user); 3) Disable or restrict logging or ensure logs (~/.openclaw/logs/...) are stored securely; 4) Configure the skill to require interactive approval for execution (raise the confidence threshold or force approval for anything non-trivial) and avoid enabling fully autonomous execution if you cannot audit every invocation; 5) If you need minimal privilege, prefer not to allow it to source dotfiles or to limit MAX_HISTORY_CHECK to 0. If you want to proceed but are unsure, keep it disabled by default and only run detect-only tests (node scripts/detect-command.js) rather than executing commands.

Type: OpenClaw Skill Name: terminal-killer Version: 1.2.0 The skill is designed to execute shell commands directly, which is a high-risk capability by nature. It attempts to mitigate this with dangerous command detection and an approval workflow. However, a critical vulnerability exists in `scripts/detect-command.js` and `scripts/exec-command.js` (and other execution paths) where user-controlled shell initialization files (e.g., `~/.zshrc`, `~/.bashrc`) are sourced via `execSync` before executing `which` or the user's command. This means any malicious code in these config files could be executed during the command detection phase, even if the user's input is not ultimately approved for execution, leading to a potential Remote Code Execution (RCE) vulnerability. While the author explicitly states the skill does not perform external API calls or data exfiltration, the inherent risk of direct shell execution with full user environment and the specific RCE vulnerability during detection make it suspicious.