Calculator

Perform mathematical calculations and unit conversions. Use when the user needs to calculate expressions, convert units (length, mass, temperature, volume, a...

This skill is coherent with its description, but the bundled Python evaluator uses compile()/eval with only a name whitelist — that protection is insufficient against certain sandbox-escape expressions (attribute/constructor chains can execute arbitrary code without introducing new names). If you plan to install or run this skill, consider: 1) Only evaluate expressions you trust (do not accept untrusted input). 2) Run the skill in a restricted environment (container, VM) if it will process user-provided expressions. 3) Prefer a patched version that avoids eval (use a safe parser/evaluator like a restricted AST evaluator, asteval, sympy.parsing, or explicit AST whitelisting of node types). 4) If you want the agent to never run this autonomously, disable autonomous invocation for the skill (set disable-model-invocation) or avoid granting it automatic invocation. If you want, I can suggest concrete safe replacements/patterns for expression evaluation or a minimal hardening patch for this script.

Type: OpenClaw Skill Name: wentianxe-calculator Version: 1.0.0 The skill provides mathematical calculation and unit conversion functionality but uses the high-risk `eval()` function in `scripts/calculator.py` to process user-supplied expressions. Although the script attempts to sandbox the execution by validating `code.co_names` against a whitelist of allowed math functions and constants and by restricting `__builtins__`, `eval()` is a known vector for Remote Code Execution (RCE) vulnerabilities. No evidence of intentional malice, data exfiltration, or harmful prompt injection was found in `SKILL.md` or the source code.