V2ray Proxy

V2Ray代理管理 - 自动开关代理、根据网络状况自动配置系统代理。使用场景：OpenClaw需要访问外网时自动开启代理、不需要时关闭。

This skill appears to do what it claims, but review and adapt before using: 1) Edit the V2RAY_DIR and related paths in scripts/v2ray-proxy.sh to point to your V2Ray/Xray installation (the provided defaults are user-specific). 2) Inspect scripts/v2ray-proxy.sh yourself — it starts/stops local binaries (nohup/pkill/pgrep) and uses eval to run wrapped commands; only run it as a non-root user you trust. 3) Back up ~/.bashrc before installing — the script appends a marker line. 4) Because the script contacts external sites (github.com, google.com) to decide if proxy is needed, be aware of that network traffic. 5) If you did not obtain this skill from a trusted source, consider running it in an isolated environment or reviewing the V2Ray binaries it will start. If you want extra assurance, ask the author for a reproducible installation path or a package from an official release host.

Type: OpenClaw Skill Name: v2ray-proxy Version: 1.0.1 The skill is classified as suspicious primarily due to a critical shell injection vulnerability in the `wrap` function within `scripts/v2ray-proxy.sh`. This function uses `eval "$cmd"` to execute user-provided commands without sanitization, allowing for arbitrary command execution (RCE) if an attacker or a malicious prompt can control the input. Additionally, the script modifies the user's `~/.bashrc` file to export `V2RAY_PROXY=1`, which, while intended as a benign flag, is a form of persistence and modification of user dotfiles without explicit consent, adding to the suspicious behavior.