Server Test Converter

将服务器测试命令 txt 文件转换为 pytest 测试用例。每个 txt 文件对应生成一个独立的 pytest 文件，命令合并到一个函数中执行。包含通用框架 test_framework.py，适配各种测试环境。

This skill appears to do what it says, but take these precautions before installing/using it: 1) Inspect your txt input files for sensitive data (passwords, tokens, IPs) because the generated pytest files will contain the command strings in cleartext. 2) Review and control the test_framework.py you use — the converter assumes you will implement send_a_cmd(); avoid hard-coding credentials in that implementation and prefer SSH keys or a secure credential store. 3) Run the converter and the produced tests in an isolated environment (non-production) until you verify behavior. 4) Verify output paths and permissions (the script writes to /home/admin/.openclaw/tytest). 5) If you need the tool to operate on a different path, update INPUT_DIR/OUTPUT_DIR in the script before running.

Type: OpenClaw Skill Name: server-test-converter Version: 1.0.1 The skill converts server test command files into pytest scripts but contains a code injection vulnerability in `convert_commands.py`. The `escape_cmd` function fails to properly sanitize input by only doubling single quotes without handling backslashes; a crafted command like `\'); <malicious_code> #` could break out of the string literal in the generated Python file to execute arbitrary code. While the tool's behavior aligns with its stated purpose, this lack of robust input sanitization in a code-generation context represents a significant security risk.