rpm-packager

Build installable RPM packages from source code on CentOS/RHEL by creating SPEC files and compiling for versions 7, 8, or 9 RPM-based systems.

This skill appears to do what it says: build RPMs using local build tools. Before using it: (1) review the included script and spec-template yourself (they are provided); (2) run builds on a non-sensitive machine or VM if you have any doubt; (3) ensure you have the required tooling installed (rpm-build, mock, gcc, make) — SKILL.md mentions them but the metadata does not; (4) the script writes to ~/rpmbuild and will include whatever is in your source directory in the package, so verify source contents to avoid packaging secrets; and (5) do not run the sudo install commands unless you trust the environment. Overall the skill is coherent and low-risk, but the metadata omissions are a documentation gap to be aware of.

Type: OpenClaw Skill Name: rpm-packager Version: 1.0.0 The skill is classified as suspicious due to a critical command injection vulnerability in `scripts/build-rpm.sh`. User-provided inputs such as `PACKAGE_NAME`, `VERSION`, and `RELEASE` are directly embedded into the generated RPM SPEC file without sanitization. This allows a malicious user to inject arbitrary commands into the SPEC file, which `rpmbuild` will execute, leading to potential Remote Code Execution (RCE). Additionally, the `SKILL.md` explicitly instructs the agent to use `sudo` for system package management, providing a high-privilege execution path that could be abused if the agent is prompted with malicious instructions or inputs.