Advanced log analysis for Docker containers using signal extraction.

This skill is coherent with its stated purpose but contains a concrete vulnerability and access risk. The Python script runs 'docker logs' by building a shell command with the container name, which allows shell injection if container names come from untrusted input. Before installing or enabling: (1) ask the author to fix the script to avoid shell=True and to pass args as a list or use the docker SDK (e.g., subprocess.run(['docker','logs','--tail',str(max_lines),container_name]) or docker-py), (2) review logs it will read because container logs can contain secrets, (3) only grant Docker access in a controlled environment (or run the skill in an isolated agent), and (4) avoid giving it autonomous invocation in high-risk contexts until the code is sanitized. If you are not able to confirm the fix, treat this skill as potentially unsafe and do not run it against production containers.

Type: OpenClaw Skill Name: docker-diag Version: 1.0.0 The `log_processor.py` script is vulnerable to command injection due to the use of `shell=True` with user-controlled input (`container_name`) in the `subprocess.run` call. This allows an attacker to execute arbitrary commands on the host system by crafting a malicious container name. While the skill's stated purpose is diagnostic, this severe vulnerability represents a high-risk capability that could be exploited for malicious execution.