Sort

Sort files, lines, and columns with custom ordering and dedup. Use when scanning duplicates, monitoring changes, reporting results, alerting anomalies.

This skill appears coherent and local-only: it sorts and analyses files using a bundled shell script and standard utilities. Before installing or invoking it, be aware that it will create ~/.local/share/sort/history.log and append entries containing the filenames and operation details (counts, flags). If you plan to run it on sensitive files, either inspect the script yourself, run it in a sandbox, or clear/relocate the history file afterwards. Also note the python fallback embeds the provided JSON key into inline Python code (unescaped), which is fine for normal keys but could misbehave with unexpected characters—prefer using jq if available. Otherwise there are no requested credentials or network endpoints to be concerned about.

Type: OpenClaw Skill Name: sort Version: 3.0.2 The skill bundle contains a critical command injection vulnerability in the `cmd_json` function within `scripts/script.sh`. The Python fallback implementation for JSON sorting interpolates the `${key}` and `${file}` variables directly into a `python3 -c` command string and a Python f-string, allowing for arbitrary code execution (RCE) if a malicious key or filename is provided. While the tool's functionality is consistent with its stated purpose and it includes documented local logging to `~/.local/share/sort/history.log`, the lack of input sanitization in a high-risk execution context warrants a suspicious classification.