Perftest

Run HTTP performance tests with latency and throughput measurement. Use when benchmarking web services. Requires curl.

This skill appears to be a straightforward curl-based benchmarking helper. Before installing or running: ensure curl (and common utilities like awk, head, seq) are available; only supply URLs you trust for testing; do not pass sensitive local filenames to report/compare (they will be read). The script writes data to ~/.local/share/perftest. Note there are minor functional bugs (some echo strings use single quotes so variables won't expand) but no signs of hidden endpoints, credential exfiltration, or unexpected network calls. If you need stronger isolation, run the script in a sandbox or container.

Type: OpenClaw Skill Name: perftest Version: 3.0.0 The skill contains multiple shell injection vulnerabilities in 'scripts/script.sh' due to the failure to quote user-supplied arguments passed to commands like 'curl', 'cat', and 'head' (e.g., in cmd_http, cmd_report, and cmd_compare). While the tool's logic aligns with its stated purpose of performance testing, the lack of input sanitization allows for arbitrary command execution if an attacker provides crafted URLs or file paths.