Ppe

Personal protective equipment tracker. Use when json ppe tasks, csv ppe tasks, checking ppe status.

This skill is a simple local CLI implemented in bash and appears to be what it claims. Before installing, note: (1) data is stored unencrypted by default under ~/.ppe (or PPE_DIR if set) — back up or move it if needed and avoid using on shared systems if entries are sensitive; (2) the script runs locally and makes no network calls; (3) you can inspect scripts/script.sh yourself (it's short and readable) before running; (4) the script uses simple line-based JSON parsing (fragile for complex values) and sed -i/grep behaviors that may differ on BSD/macOS vs Linux — test on your platform. If you want stronger isolation, run it in a container or inspect/modify the script to suit your policies.

Type: OpenClaw Skill Name: ppe Version: 1.0.0 The skill implements a local PPE tracker but contains a command injection vulnerability in `scripts/script.sh` within the `cmd_config` function. Specifically, user-provided keys and values are passed unsanitized to a `sed -i` command, which could allow for arbitrary file manipulation or, on systems with GNU sed, remote code execution (RCE) via the `e` flag. While the tool's behavior aligns with its stated purpose, the lack of input validation in a shell script environment is a significant security flaw.