My Shell

Runs shell commands inside a dedicated tmux session named claw, captures output, and prompts before executing potentially destructive commands.

Don't install this skill into sensitive agents as-is. The handler constructs a shell command string and only escapes double quotes, so user-supplied content containing shell substitutions (e.g., $(...), `...`, $VAR expansions) will be executed by the host shell before tmux receives the input — this is an RCE risk. The 'dangerous' filter is a simple substring check and can be bypassed by common command forms. If you need this functionality: (1) ask the author to stop using execSync with a single command string and instead use a subprocess API that avoids a shell (e.g., child_process.spawn or execFile with argument arrays, or execSync with shell disabled), or at minimum properly escape/validate all special shell metacharacters; (2) strengthen the dangerous-command detection and require explicit user confirmation for destructive commands; (3) run the skill in an isolated, non-root container or sandboxed environment and avoid running on hosts with sensitive data. If you cannot get those fixes, treat the skill as unsafe and do not give it access to agents running on production or privileged hosts.

Type: OpenClaw Skill Name: my-shell Version: 1.0.0 The skill provides a persistent shell interface via tmux, which is a high-risk capability. The implementation in handler.js contains a command injection vulnerability because it uses execSync with insufficient sanitization (only escaping double quotes, leaving backticks and subshells vulnerable). While it includes a basic safety filter (isDangerous), the overall design allows for arbitrary code execution on the host beyond the intended tmux session.