MegaSquirt Tuner

Megasquirt ECU tuning and calibration via TunerStudio, covering VE table, ignition timing, AFR targets, sensor calibration, accel enrichment, boost, launch c...

This skill appears coherent for analyzing .msq tune files and giving tuning advice. Things to consider before installing or using it: (1) If you run scripts locally, inspect scripts first — the included scripts are local and benign-looking, but always verify code you execute. (2) The analyzer asks you to provide .msq files; avoid pasting any files that contain sensitive metadata you don't want shared in chat. (3) The file-validation function has a subtle check issue: it resolves the given path and then checks for symlinks, which can allow some symlink-based bypasses — run the analyzer on copies in a safe directory or in a sandbox if you're concerned. (4) There are no network/exfiltration calls in the provided files, and no credentials are requested. If you plan to allow the agent to autonomously invoke the skill, be mindful that it could read local .msq files you provide during invocation — restrict what you upload and prefer running analysis locally in an isolated environment.

Type: OpenClaw Skill Name: megasquirt-tuner Version: 1.0.2 The skill is classified as suspicious due to its capability to execute a local Python script (`scripts/analyze_msq.py`) with a user-provided file path. While this is a risky capability involving file system interaction, the `analyze_msq.py` script implements robust security measures in its `validate_filepath` function, effectively preventing common attacks like path traversal, arbitrary file reads, and symlink exploitation. The script's purpose is legitimate tune file analysis, and there is no evidence of malicious intent such as data exfiltration, persistence, or unauthorized remote control. The `SKILL.md` also explicitly outlines security restrictions, which are correctly implemented in the Python code.