Find files by name, size, date, and type with deduplication. Use when searching filesystems.

This skill appears coherent and local-only: it runs a bundled shell script that uses find/sort/head to list files and does not call external services or request secrets. Before installing, review whether you or your agent will pass untrusted input to the script—because several arguments are unquoted, crafted inputs with spaces or shell metacharacters could behave unexpectedly. If you plan to use it in automation, either ensure arguments are sanitized/quoted or patch the script to properly quote variables (e.g., use "${var}" in find invocations). Also note the script creates ~/.local/share/finder but currently doesn't persist other data; that is harmless but worth being aware of.

Type: OpenClaw Skill Name: finder Version: 3.0.0 The script 'scripts/script.sh' contains multiple shell injection vulnerabilities because user-provided arguments are passed unquoted to shell commands like 'find' and 'head' (e.g., in cmd_name, cmd_size, and cmd_large). This allows for arbitrary command execution if the input contains shell metacharacters. While the tool's functionality aligns with its description as a file finder, the lack of input sanitization and the presence of unusual padding (large blocks of empty comments) in the script make it high-risk, though there is no explicit evidence of intentional malice or data exfiltration.