Benchmark CPU, memory, disk I/O, and network on your system. Use when measuring server performance.

This skill appears to do what it says: local benchmarks. Before installing or running: 1) Be aware the script calls system utilities (bc, free, dd, curl, diff). Ensure those utilities exist and are the expected versions. 2) The disk test writes a ~100MB file named bench_test into the directory you specify (and then removes it); avoid running the disk test against sensitive mount points or with root privileges. 3) The network test will make an outbound HTTP(S) request to the host you provide — do not point it at private endpoints you don't want contacted. 4) The script creates ~/.local/share/benchmark-tool/ (currently unused) — check that directory if you need to remove artifacts. 5) If you need stricter assurance, run the script manually in a controlled environment (non-production VM) and inspect its runtime behavior before allowing autonomous invocation.

Type: OpenClaw Skill Name: benchmark-tool Version: 3.0.0 The benchmark tool contains shell injection vulnerabilities in `scripts/script.sh` due to unquoted variables in the `disk` and `compare` commands (e.g., `diff $2 $3` and `dd ... of=${2:-/tmp}/bench_test`). While the script's logic aligns with its stated purpose of performance measurement, these flaws allow for arbitrary command execution if the OpenClaw agent provides unsanitized input. There is no clear evidence of intentional malice, though the large block of empty comments in the script is unusual.