File Organizer Skill

Organize files in directories by grouping them into folders based on their extensions or date. Includes Dry-Run, Recursive, and Undo capabilities.

Install only if you are comfortable with a local script that moves files. Use dry-run first, run it only on directories you explicitly choose, avoid recursive mode on broad folders, and do not use --undo with a history file you did not create and inspect.

Type: OpenClaw Skill Name: file-organizer-skill Version: 1.0.0 The `scripts/organize.py` skill is suspicious due to a critical file movement vulnerability in its `undo` functionality. The `undo` function takes a user-supplied `log_file` path without sufficient validation. This `log_file` is parsed as JSON, and its `src` and `dst` fields are directly used in `shutil.move(dst, src)`. An attacker could craft a malicious `organize_history.json` file containing arbitrary `src` and `dst` paths, allowing them to move any file on the system (e.g., `/etc/passwd` to `/tmp/backup` or vice-versa) by executing the skill with the `--undo` flag, leading to potential data tampering, denial of service, or privilege escalation.