uf2.net URL Shortener

Create, manage, and track custom short URLs with uf2.net API; links never expire and provide click counts and public stats via simple REST calls.

This skill appears to do what it says: a small CLI wrapper around uf2.net. Before installing: (1) be aware it requires your uf2.net API key (UF2_API_KEY) — prefer adding that to a secure secret store rather than plaintext shell profiles, (2) the package metadata does not list the required env var (UF2_API_KEY) although the SKILL.md and script require it — treat that as a bookkeeping error and confirm your environment handling, and (3) the included script builds JSON bodies by naive string concatenation (no escaping). That can break on inputs containing quotes/newlines and could cause malformed requests; if you accept untrusted input into the script, consider improving it to safely escape JSON (for example using jq --arg or printf with proper escaping). If you rely on this skill in an automated agent, ensure the agent's secret storage and policy enforce secure handling of UF2_API_KEY and review the script changes above.

Type: OpenClaw Skill Name: uf2-net Version: 1.0.1 The skill is classified as suspicious due to critical command injection vulnerabilities found in `scripts/uf2.sh`. The `cmd_create` function directly interpolates user-provided arguments (`url`, `slug`, `title`) into a JSON string without proper shell escaping, which allows for arbitrary command execution via `$(command)` injection. Additionally, `cmd_list`, `cmd_get`, and `cmd_delete` are vulnerable to URL parameter and path injection due to direct interpolation of user input into `curl` arguments. These are significant vulnerabilities, but there is no clear evidence of intentional malicious behavior (e.g., data exfiltration, backdoors) by the skill itself, only flaws that allow an attacker to exploit the agent running the script.