RegexAssistant

帮助测试、调试和生成正则表达式，支持匹配测试、分组捕获、全文提取和替换操作。

This skill appears to do what it says: a local regex tester implemented in a small Python script and documentation. Key points to consider before installing/using: (1) it runs locally and needs no credentials, so there's no obvious network exfiltration built in; (2) be cautious when passing sensitive files as arguments or via shell substitution (e.g., $(cat secret.txt)) since the tool will print matches and replaced text to stdout; (3) you can quickly review the short script (script/main.py) — it contains only standard Python regex usage with no network or filesystem access beyond what you explicitly provide as arguments. If you require higher assurance, run the script in a sandbox or review/execute it locally before granting it any automated invocation.

Type: OpenClaw Skill Name: regex-assistant Version: 1.0.1 The skill's `SKILL.md` documentation describes executing `python3 script/main.py` with user-controlled regex patterns and text as command-line arguments. This design, especially highlighted by an example using shell command substitution (`$(cat error.log)`), creates a significant shell injection vulnerability if the OpenClaw agent does not properly quote or escape user-provided input when constructing the command string for execution. While the `script/main.py` itself is benign and uses standard Python libraries without malicious logic, the described invocation method in `SKILL.md` exposes the agent to a critical command injection risk.