Terminal Executor

Execute terminal commands with optional sudo privileges and return the command output safely upon user request.

This skill legitimately runs arbitrary shell commands (including prefixed with sudo). Before installing, confirm you trust the author and environment where it will run. Consider: 1) avoid running the skill with sensitive account access or secrets available in the environment; 2) require explicit human confirmation before any destructive or privileged commands — the skill's docs suggest this but do not enforce it; 3) review the code (tools/exec.js and tools/sudo_exec.js) and, if possible, run in a sandbox or VM first; 4) be aware that command output may leak secrets or system data, and sudo commands may prompt for credentials or fail silently. If you need stricter controls, prefer a wrapper that enforces command whitelisting and explicit confirmations.

Type: OpenClaw Skill Name: terminal-executor Version: 1.0.1 The skill provides arbitrary shell command execution capabilities, including a dedicated tool for sudo access (tools/sudo_exec.js and tools/exec.js). While these tools align with the stated purpose of a 'terminal executor,' they grant the AI agent unconstrained control over the host system without any input sanitization or command filtering, posing a significant risk of Remote Code Execution (RCE). No evidence of intentional malicious payloads, exfiltration, or obfuscation was found.