Skylv Smart Renamer

Batch rename files using pattern matching and AI suggestions

This skill runs locally and does not contact external endpoints or request credentials, but there are important concerns before you use it on real data: - Mismatch: The README/metadata claims "AI suggestions" but the provided code contains no AI integration — it only applies fixed rename rules. - Data-loss risk: The implementation has bugs that can overwrite files. Notably, the sequence rule returns the same filename for every file (so multiple files may be overwritten), and the code does not check for or avoid destination name collisions when renaming. Node's fs.renameSync may replace existing files on many systems, causing irreversible data loss. - Limited preview and weak validation: Preview only shows up to 20 files; replace uses a user-supplied regex directly (may throw or behave unexpectedly); extension and other args are not validated. - Local history: A .rename-history.json file is written into the target directory; this is local but may contain filenames you may not want recorded. Recommendations before installing/using: - Do not run this on irreplaceable files. Back up the directory first or test in a disposable copy. - Inspect and/or patch the code: fix the sequence rule so it increments per-file, add collision checks (skip/auto-increment/abort on conflict), validate or escape user-supplied regexes, and surface clear warnings in the UI/docs. - Run preview and manually review the full set of proposed changes (the preview currently shows only the first 20 files). - If you expect AI-driven suggestions, request or implement AI integration — currently it's a deterministic renamer only. Given these mismatches and risky behaviors, the skill is coherent enough to be useful after fixes, but it's not safe to run on important files in its current form.

Type: OpenClaw Skill Name: skylv-smart-renamer Version: 1.0.1 The skill provides batch file renaming functionality but contains multiple security vulnerabilities in `smart_renamer.js`. The `prefix`, `suffix`, `replace`, and `extension` rules fail to sanitize input arguments, allowing for path traversal attacks where files could be moved or renamed outside the intended directory. Additionally, the `replace` rule uses unsanitized input to construct a `new RegExp()`, making it vulnerable to Regular Expression Denial of Service (ReDoS), and the `sequence` rule is logically flawed, which could lead to accidental file overwrites.