Runs shell commands exclusively inside tmux session 'claw', captures output, and requests confirmation for potentially destructive commands.

This skill appears to do what it says, but do not install it without review because of implementation issues: (1) it implicitly requires the 'tmux' binary but doesn't declare it; (2) handler.js constructs shell commands with only double-quote escaping, allowing shell interpolation (backticks/$(...)/$vars) to be executed by the local shell when execSync runs — that can execute payloads on the host outside tmux and prior to any user confirmation; (3) the dangerous-command check is simplistic and may miss other harmful inputs; and (4) the ownerId in _meta.json doesn't match the registry metadata (possible repackaging). If you plan to use this skill: run it in a safe/test environment first, ask the author to (a) declare tmux as a required binary, (b) fix sendCommand to avoid shell interpretation (use execFile/spawn with args or properly escape/disable shell evaluation), and (c) strengthen dangerous-command detection or enforce an explicit prompt/approval step before any local execution. If you cannot validate those fixes, treat the skill as untrusted and avoid using it on production or sensitive machines.

Type: OpenClaw Skill Name: claw-shell-1-0-0 Version: 1.0.0 This skill is highly suspicious due to its core functionality of executing arbitrary shell commands via `execSync` in `handler.js`. It contains a critical shell injection vulnerability in the `sendCommand` function, where user-provided commands are passed directly to `tmux send-keys` without adequate shell-level sanitization, allowing for arbitrary command execution. Furthermore, the `isDangerous` function, intended as a safety mechanism, relies on an easily bypassable blacklist, which allows dangerous commands (e.g., `curl`, `wget`, `cat /etc/passwd`) to be executed without triggering the user confirmation prompt specified in `SKILL.md`, effectively bypassing the agent's safety instructions. The `readOutput` function also captures and returns the output of these commands, enabling potential data exfiltration.