Schema Builder

Build database schemas with SQL generation and relationship modeling. Use when designing databases.

This skill appears to be a local schema-generation utility and is internally consistent with its description. Before installing or permitting autonomous execution: 1) note that there are two scripts—script.sh (documented) and schema.sh (undocumented commands) — both generate text only and do not contact external servers; 2) the tool will create ~/.local/share/schema-builder for its outputs; 3) the shell scripts have minor quoting bugs (harmless but could produce incorrect output), so run them in an isolated environment (or inspect/patch them) if you plan to run on production systems; and 4) because the skill can be invoked autonomously by the agent, restrict autonomous execution if you are uncomfortable with any code running locally without supervision.

Type: OpenClaw Skill Name: schema-builder Version: 3.0.0 The skill bundle contains a shell injection vulnerability in `scripts/script.sh` within the `cmd_validate` function, where the second argument is used unquoted in a shell command (`[ -f $2 ]`), allowing for arbitrary command execution if a malicious filename is provided. Furthermore, `scripts/script.sh` is poorly implemented with broken variable interpolation (using single quotes for shell variables) and contains a large block of empty comment lines, a technique often used to hide malicious code from quick visual inspection. While no explicit evidence of data exfiltration or intentional malice was found, the combination of critical vulnerabilities and suspicious coding patterns warrants a suspicious classification.