unzip-all

递归解压所有嵌套的压缩包(zip/7z/rar)，支持中文文件名。用于解压包含多层嵌套压缩包的文件夹。

This skill appears to do exactly what it says, but take precautions before using it on important data: - Backup your archives or test the skill on a copy first — the script deletes original archives after successful extraction. - The zip extraction does not sanitize archive member names (no zip-slip protection). Malicious archives could write files outside the target folder; avoid running this on untrusted archives or add path-sanitization checks (ensure final paths are under the extraction directory using abspath checks). - The script searches the Windows registry for 7‑Zip and uses Windows-style paths; it may not work on non-Windows systems or systems where 7z is in PATH but not registered. Confirm 7‑Zip is installed and accessible. - If you want safer behavior, modify the script to: (a) not auto-delete originals (or make deletion optional), (b) validate member paths (reject absolute paths and any path that escapes the target directory), and (c) look for 7z on PATH for non-Windows OSes. If you accept those limitations and run it in a controlled environment (or after applying the suggested fixes), the skill is coherent with its stated purpose.

Type: OpenClaw Skill Name: unzip-all Version: 1.0.0 The script scripts/unzip_all.py is vulnerable to a ZipSlip attack because it extracts files using paths stored within the archive (after decoding) without sanitizing them against path traversal (e.g., '../'). Additionally, the script automatically deletes original archive files after extraction (os.remove), which is a destructive action that could lead to data loss if extraction is only partially successful or if the archive contains malicious paths. It also executes an external binary (7z.exe) located via the Windows registry or hardcoded paths.