Safely apply OpenClaw config changes with automatic rollback and ack timeout guard. Use when editing ~/.openclaw/openclaw.json, restarting gateway, enabling...

This skill is internally coherent but treat it as powerful: it will overwrite your OpenClaw config and restart the gateway. Before running: 1) Ensure the 'openclaw' CLI is installed and functional (the script assumes it though the metadata doesn't declare it). 2) Carefully review and control the --apply-cmd you provide — the script uses eval and will execute whatever you pass (use a deterministic script you inspected, not untrusted input). 3) Run first in a safe/test environment to verify the health-check string and restart behavior. 4) Verify filesystem ownership and that backups are stored where you expect; be cautious with symlinked config files and permissions to avoid accidental overwrite of unintended files. 5) Prefer running as a user with just enough privileges (not root) unless elevated rights are required. If you want higher assurance, request that the skill metadata be updated to declare the 'openclaw' binary requirement and, optionally, replace eval usage with a safer invocation pattern.

Type: OpenClaw Skill Name: elegant-config-guardian Version: 0.1.0 The skill's core script, `scripts/safe_apply.sh`, uses `eval "$APPLY_CMD"` to execute a user-provided command. This creates a severe shell injection vulnerability, allowing arbitrary command execution (RCE) with the privileges of the OpenClaw agent. While the skill's stated purpose is to safely apply configuration changes and the code itself does not contain explicit malicious payloads or instructions for data exfiltration, persistence, or unauthorized access, this critical flaw makes it highly exploitable, classifying it as suspicious.