Perform audio editing tasks including trimming, volume adjustment, format conversion, and extracting audio from video files using natural language commands.

This skill performs audio work with ffmpeg, which matches its description, but the included script constructs shell commands and uses eval on user-provided text. That allows arbitrary shell execution if input is not strictly controlled. Before installing or running: (1) ensure you trust the skill source; (2) inspect and test the script in a safe environment; (3) do not run it with untrusted natural-language inputs; (4) consider patching the script to remove eval, build command arrays, properly quote/escape filenames, and whitelist acceptable operations; (5) ensure ffmpeg, grep -P, and bc are available. If you need the same functionality in a higher-security context, prefer a version that avoids eval and validates inputs.

Type: OpenClaw Skill Name: audio-editor Version: 1.0.0 The skill is highly suspicious due to a critical shell injection vulnerability (RCE) found in `scripts/audio_run.sh`. The `parse_natural_language` function, if it fails to match specific audio processing patterns, directly echoes the user-provided `command` parameter. This unsanitized output is then executed via `eval "$AUDIO_CMD"` in the main logic, allowing an attacker to execute arbitrary shell commands. While this is a severe vulnerability, there is no clear evidence of intentional malicious behavior like data exfiltration or persistence, classifying it as a flaw that *allows* attacks rather than being *designed* to attack.