Spell

Log anything fast and find it later with search and export. Use when running lookups, checking entries, converting formats, generating summaries.

This skill appears to do what it says: a simple offline logger/search/export tool that keeps data locally at ~/.local/share/spell. Before installing or using it: 1) review and, if needed, audit scripts/script.sh locally (it will append whatever you type to plaintext log files); 2) be careful not to enter passwords, API keys, or other secrets into entries (they will be stored unencrypted); 3) note there are no install steps provided — you may need to make scripts/script.sh executable and place it on your PATH (or adapt the SKILL.md commands); 4) optional: restrict permissions on the data dir (chmod 700 ~/.local/share/spell) if you want to limit access. Minor technical notes: the export JSON newline handling and search behavior could be improved (e.g., grep option handling for terms starting with '-') but these are implementation issues rather than security red flags.

Type: OpenClaw Skill Name: spell Version: 2.0.0 The SKILL.md file contains raw shell command interpolation sequences (e.g., `$(du ...)` and `$(cat ...)`) directly within the instruction table. While these specific commands are limited to calculating disk usage and line counts within the tool's own data directory (~/.local/share/spell/), providing executable shell syntax in markdown intended for an AI agent is a high-risk pattern that could be leveraged for command injection. The underlying script.sh is a benign logging utility that lacks any evidence of intentional malice, data exfiltration, or persistence.