sausg

SAUSG（结构通用分析与设计软件）自动计算与操作工具。用于弹塑性计算、非线性分析、动力时程分析、隔震减震设计、钢结构分析等。当用户提及 SAUSG、SAUSAGE、OpenSAUSG、SAUSGDelta、SAUSGJG、SAUSGPI、SAUSGZeta 等相关软件，或要求进行弹塑性计算、读取计算结果时使用此技能。

This skill appears to do what it claims (local automation for SAUSG). Before installing or running it, consider: 1) It expects a Windows environment and will search local drives and launch SAUSG executables — only use it on machines where SAUSG is installed and trusted. 2) The scripts spawn local processes with shell=True and build command strings containing file paths; avoid passing untrusted or attacker-controlled model paths to prevent command injection risks. 3) The skill performs cleanup of old result files by default (SKILL.md mentions this) — if you need to preserve results, use the provided --no-cleanup option or inspect the code to confirm behavior. 4) The scripts optionally parse Word (.docx) files using python-docx if installed; installing that dependency is optional but may be required for some features. 5) Minor inconsistencies in default directories (SKILL.md vs code) mean you should verify the configured path before running. If you are unsure, review the three included Python files locally or run them in a controlled/sandbox environment with test data first.

Type: OpenClaw Skill Name: sausg Version: 1.0.1 The skill bundle automates SAUSG structural analysis software but contains critical shell injection vulnerabilities. Specifically, `sausg_calc.py` and `sausg_open.py` use `subprocess` with `shell=True` to execute commands constructed from unvalidated user-provided paths (e.g., `model_path`). Additionally, `sausg_calc.py` includes a cleanup function that performs recursive deletions of specific folders and files in the model directory. While these behaviors are risky and could be exploited for RCE, they appear to be unintentional flaws or documented features for engineering workflows rather than intentional malware.