obs

Comprehensive Open Build Service (OBS) management with full API support for projects, packages, repositories, builds, submit requests, files, users, and search.

What to check before installing/running: - Review the two bundled scripts (references/obs-lib.sh and scripts/obs-expert-setup.sh) yourself; all code is included. - The skill needs your OBS API token (OBS_USERNAME/OBS_TOKEN) or an oscrc file; only supply a token you trust and keep it minimal-scope and rotatable. - The setup script will write ~/.config/osc/oscrc and can append credentials to your shell rc (~/.bashrc or ~/.zshrc). Prefer using ~/.config/osc/oscrc with chmod 600 rather than storing tokens in shell rc. - Do not run the setup script as root unless you deliberately want to create system-wide symlinks; creating a symlink in /usr/local/bin requires root and expands the attack surface. - The API library uses eval to construct curl commands; if you plan to pass filenames or other inputs containing untrusted content, inspect or sanitize inputs to avoid command injection. - Test in a safe environment (non-production user or container) first. If you proceed, rotate the token after initial testing and follow least-privilege practices. - If anything looks unexpected (external endpoints other than api.opensuse.org, unusual network calls, or credential exfiltration), do not proceed and ask for clarification from the author.

Type: OpenClaw Skill Name: obs Version: 1.0.1 The skill bundle provides a comprehensive interface for Open Build Service (OBS) management but contains a critical shell injection vulnerability in 'references/obs-lib.sh'. The 'obs_api_call' function uses 'eval' to execute 'curl' commands, which can be exploited for remote code execution (RCE) if an attacker or a malicious prompt influences the arguments (such as the 'data' or 'endpoint' parameters). While the tool's stated purpose is legitimate and the setup script 'scripts/obs-expert-setup.sh' follows standard (though sensitive) credential handling practices, the presence of such a high-risk coding flaw warrants a suspicious classification.