openclaw-plus

A modular super-skill combining developer and web capabilities. Use when the user needs Python execution, package management, git operations, URL fetching, o...

This skill is internally consistent with its advertised purpose: it runs Python, installs packages (pip/apt), manipulates git repos, and makes network requests. Those are exactly the powerful operations you should expect. Before enabling or allowing autonomous use, consider: 1) Run it in a sandbox or throwaway environment if you plan to allow package installs or arbitrary code execution; 2) Be careful about committing files to git — review content for secrets before committing; 3) System package installs require sudo and can change the host; avoid on sensitive machines; 4) Don’t supply sensitive credentials unless necessary and only pass them directly to the call_api call (the skill does not automatically read env secrets); 5) If you plan to allow autonomous invocation, restrict scope or monitor runs because the skill can modify disk, install packages, and call external URLs. If you want a safer posture, enable the skill only for user-invoked sessions and review the implementation.py source before use.

Type: OpenClaw Skill Name: openclaw-plus Version: 1.0.0 The skill provides powerful developer and web automation capabilities, including arbitrary Python code execution, package installation (with `sudo` for system packages), git operations, and network requests. While these capabilities are aligned with its stated purpose, the `scripts/implementation.py` file exhibits significant vulnerabilities. Specifically, the `install_package` function (especially with `system=True` using `sudo apt-get`) and `git_commit` directly pass unsanitized user-provided strings to `subprocess.run`, creating clear shell injection and arbitrary command execution risks. The `run_python` function also executes arbitrary Python code without explicit sandboxing within the skill itself. These are critical vulnerabilities that could lead to Remote Code Execution and Privilege Escalation if user input or agent instructions are not rigorously sanitized by the OpenClaw environment, classifying the skill as suspicious rather than benign. There is no evidence of intentional malicious behavior (e.g., pre-programmed data exfiltration or backdoors).