Notice Monitor

自动监控任意网站公告列表页，支持关键词过滤、多层级分类、定时推送及多渠道通知（钉钉、微信、邮件）。

What to consider before installing: - Major risk: the skill shells out to openclaw with the notification message embedded in a single command string. Because the message is built from scraped titles (external websites), an attacker-controlled site could craft content that executes arbitrary shell commands on your host. Don’t install or run this skill on systems you cannot afford to compromise. - If you still want the functionality, ask the author to patch before use: replace execSync(string) with a safe alternative (execFile/spawn with argument array or use the OpenClaw messaging API/library), or thoroughly sanitize/encode the message to prevent shell expansion (escape $, `, \\, newlines, etc.). - Ask for or apply these fixes: implement the other promised notify channels (webhook/email/wechat) properly; make state/log paths configurable (use ~/.openclaw/workspace by default) and document required host CLI credentials; avoid saving state inside the installed package directory. - Additional operational notes: Puppeteer will download/consume a Chromium binary and increase disk/network usage. Only run on trusted hosts and consider running inside an isolated container or VM until the command-injection issue is resolved. Confidence notes: High — the execSync call with interpolated, unsanitized message text is visible in code and is a straightforward command-injection vector. If you can confirm that the host 'openclaw message' CLI itself safely treats its arguments (no shell expansion) and that execSync is invoked in non-shell mode (not the case here), or that all monitored sites are fully trusted and cannot be tampered with, that would reduce the risk.

Type: OpenClaw Skill Name: notice-monitor Version: 1.0.1 The notice-monitor skill contains a critical command injection vulnerability in src/monitor.js. The Notifier.send function uses child_process.execSync to call the openclaw CLI, passing a message string constructed from notice titles scraped from external websites. While the code attempts to escape double quotes, it fails to sanitize other shell metacharacters like backticks (`) or shell expansions ($()), allowing a malicious website to potentially achieve Remote Code Execution (RCE) on the agent's host. This is classified as suspicious rather than malicious because it appears to be a severe implementation flaw rather than an intentional backdoor.