Taildrop

Download files from Tailscale Taildrop inbox to local storage. Use when user wants to retrieve files sent via Tailscale or mentions Taildrop.

This skill appears to do what it says (download Taildrop files), but review these points before installing or running it: - Ensure the 'tailscale' CLI is installed from an official source; the skill should have declared this dependency. - The SKILL.md suggests setting your account as a Tailscale operator with sudo. That is a system-level change; understand what operator privileges mean for your Tailscale setup before doing it. If you prefer, run the script with sudo per-download instead of permanently changing operator status. - The script uses eval to run the constructed command. Avoid passing untrusted or specially-crafted directory paths to the script (do not call it with user-supplied input you don't control) because that can enable command injection. Consider removing eval or using an array-based exec if you plan to modify the script. - If you are cautious, inspect and run the script manually (not as root) to verify behavior on a disposable test machine or directory before using it in production.

Type: OpenClaw Skill Name: taildrop Version: 1.0.0 The skill is classified as suspicious due to the use of `eval` in `scripts/taildrop-get.sh`. While the script attempts to quote user-provided input (`TARGET_DIR`) within the command string passed to `eval`, `eval` is an inherently dangerous function that can lead to shell injection vulnerabilities if the input string is not perfectly sanitized or if it contains maliciously crafted quotes. This represents a potential vulnerability, not clear malicious intent, aligning with the 'suspicious' classification.