Shipping Calc

Calculate shipping costs with zone-based rates and duty estimates. Use when estimating shipping costs.

This skill appears to do what it says: local shipping/duty calculations with a small bash script and no network or credential access. You can install/use it with low risk, but consider: (1) the script has minor bugs (track/batch echo lines won't expand variables), and (2) for safety with untrusted input the script should pass shell variables into awk with -v instead of interpolating them into the awk program. If you plan to run it on sensitive systems or feed untrusted inputs, review/patch the script first. Otherwise it's lightweight and coherent with its description.

Type: OpenClaw Skill Name: shipping-calc Version: 3.0.0 The skill contains multiple critical command injection vulnerabilities in `scripts/script.sh`. Specifically, the `rate`, `compare`, `estimate`, and `duty` functions pass unsanitized shell arguments directly into `awk` command strings (e.g., `awk "BEGIN{...$2...}"`), which allows for arbitrary code execution if a user provides crafted input. While the script's logic aligns with its stated purpose and lacks explicit evidence of intentional malice or exfiltration, the high-risk nature of these vulnerabilities warrants a suspicious classification.