skill-isolator

Project-based skill isolation and management. Enables different projects to use different skill sets with automatic loading based on current working director...

What to check before using this skill: - The sync script runs 'clawhub install <skill>' via execSync. Make sure you have the 'clawhub' CLI installed and trust it before running the sync script; the skill does not declare this as a required binary in its metadata. - The scripts will read and write files under your home directory (e.g., ~/.openclaw/cache, ~/.openclaw/logs, ~/.openclaw/skills). If you prefer not to have those paths written, review/modify the code first. - Example config mentions GitHub token (GITHUB_TOKEN) for git sources; if you later enable git/url sources you may need to expose credentials. The current sync script reports git/url as 'not yet implemented', but the validate/example files reference auth, so be cautious if you edit configs to include credentials. - SKILL.md says skills will 'auto-sync on project enter' — the package provides flags and config options but no background watcher; you'll need to wire the sync script into your shell, editor, or agent to get automatic behavior. - Recommended actions: inspect the scripts locally (they are small and readable), run validate-config.js on any config you create, and run sync-project-skills.js in a test directory first to observe what it writes and what external commands it invokes. If you do not want the 'clawhub' dependency or any network installs, avoid running the sync script or remove/modify the installFromClawhub function.

Type: OpenClaw Skill Name: skill-isolator Version: 1.0.0 The skill bundle provides a utility for project-based skill isolation but contains a shell injection vulnerability. In `scripts/sync-project-skills.js`, the `installFromClawhub` function uses `execSync` to execute shell commands constructed directly from the `skillName` and `version` fields found in the `.openclaw-skills.json` configuration file without any sanitization. A maliciously crafted configuration file could exploit this to run arbitrary system commands. While the overall logic appears aligned with its stated purpose and lacks evidence of intentional malice or data exfiltration, the high-risk implementation of system calls qualifies it as suspicious.