Travel Frog 旅行青蛙

A travel frog that autonomously explores the world, sends postcards, and takes photos.

This skill appears to be a local, file-backed 'travel frog' that personalizes behavior by reading/writing files in your workspace. Before installing or enabling it: - Note it will read workspace/IDENTITY.md and recent memory diary files and will append diary entries (echo >> ...) — if you keep sensitive data in those locations, the skill will access/modify it. - It will create a travel-frog-data directory (default under your workspace) and write logs, state.json, collections.json, postcards, and backups. If you want isolation, set FROG_STATE_DIR to a sandbox directory before running. - Templates instruct calling external image-generation scripts (OpenAI/Gemini) via exec; those calls may use other skills or local credentials. Review or sandbox any referenced image-generation scripts and their credentials. - Recommended precautions: back up workspace files you care about, run the skill in a dedicated workspace or set FROG_STATE_DIR to an isolated path, and review the image-generation toolchain it will invoke. If you need a tighter boundary, request a version that confines all reads/writes strictly to its own skill directory.

Type: OpenClaw Skill Name: travel-frog Version: 1.0.0 The skill bundle implements a 'Travel Frog' simulation but contains a significant shell injection vulnerability in its operational instructions. AGENTS.md and HEARTBEAT.md repeatedly instruct the AI agent to use 'echo >> file' via the 'exec' tool to record diary entries and world knowledge. Because the content being echoed is generated by the AI based on game events, it could inadvertently (or via prompt manipulation) include shell metacharacters (e.g., semicolons, backticks, or command substitutions) leading to arbitrary command execution. While the core Python logic in scripts/frog_engine.py is functionally benign, the prescribed method for data persistence in the markdown instructions creates a high-risk attack surface.