Nlp

Process text with NLP. Use when tokenizing, analyzing sentiment, extracting entities, summarizing documents, or measuring similarity.

This skill appears coherent and runs a local Bash script that processes only input you provide. Before installing/using: (1) verify your environment has Bash 4+, grep with -P support, and awk (the script requires these), (2) run the script on non-sensitive sample text first to confirm behavior, and (3) review the full script contents yourself if you will run it on sensitive data — while no network or credential use is present, executing any third-party script has inherent risk. If you need macOS compatibility, note that the default BSD grep may lack -P (Perl regex); consider installing GNU grep or testing functionality first.

Type: OpenClaw Skill Name: nlp Version: 3.4.2 The skill provides a functional NLP toolkit in Bash but contains a shell injection vulnerability in the `cmd_classify` function within `scripts/script.sh`. The `--categories` argument is parsed and its values are used directly within a `grep` command inside a subshell (`$(...)`) without sanitization, allowing for arbitrary command execution if an attacker provides crafted category names. While there is no evidence of intentional malice or data exfiltration, this critical security flaw poses a significant risk if the agent processes untrusted input.