Perform mathematical calculations from the command line. Arithmetic, trig, and unit conversion.

Do not run this tool with untrusted input or as a privileged user. The calc implementation uses Python eval on raw expressions, which can run arbitrary Python code (not just math); this can be exploited to execute shell commands, read files, or modify the system. Before installing or using: (1) inspect or run the script in an isolated environment (container/VM) if you must test it; (2) prefer a fixed safer implementation (use a math expression parser or a sandboxed evaluator like asteval/numexpr or parse the AST and whitelist nodes/functions); (3) if you need this exact tool, modify evaluate() to strictly validate the expression (allow only digits, operators, parentheses, decimals, and an explicit whitelist of math function names) or replace eval with a safe evaluator; (4) avoid running it on sensitive hosts or with elevated privileges. If you want, I can suggest a safe replacement implementation or a patch to restrict allowed tokens and AST nodes.

Type: OpenClaw Skill Name: calc-tool Version: 1.0.0 The script 'scripts/calc.py' contains a critical Remote Code Execution (RCE) vulnerability due to the use of the 'eval()' function on unsanitized user input. While the tool is presented as a simple calculator, an attacker can bypass the intended mathematical logic to execute arbitrary Python code (e.g., using '__import__'). There is no evidence of intentional malice or exfiltration, but the implementation is highly insecure.