系统命令

执行Windows常见系统命令（如ipconfig、tasklist、netstat、systeminfo及别名命令）并返回格式化结果，支持安全分级和自定义配置。

This skill appears to do what it claims (run Windows commands) and contains code that enforces whitelists, timeouts and forbidden-pattern checks. Before installing: 1) Confirm you only run it on Windows test machines or VMs — the implementation expects PowerShell/CMD. 2) Review the bundled scripts (especially v3/v4) and config.json yourself; aliases can expand into commands. 3) If you don't need custom command execution, disable or remove the /system_cmd exec feature to avoid arbitrary command execution. 4) Don't grant the agent or this skill administrative privileges; high-risk operations will still run if invoked with elevated rights. 5) Be aware filters use regex/heuristics and could be bypassed; consider running the skill in an isolated environment and auditing logs. 6) Note the packaging inconsistencies (docs mentioning Python, metadata claiming instruction-only), which suggest the package may have been assembled sloppily — request the author clarify or provide a clean, single-language implementation if you require higher assurance.

Type: OpenClaw Skill Name: system-cmd Version: 1.0.0 The skill bundle provides a Windows system command execution engine, allowing an AI agent to run utilities like ipconfig, tasklist, and arbitrary shell commands via an 'exec' mode. While the implementation in system_cmd_v4.js includes multiple security layers—such as a command blacklist (FORBIDDEN_COMMANDS), regex-based pattern matching (HIGH_RISK_PATTERNS), and a mandatory confirmation flag (--yes) for dangerous operations—the core functionality is essentially a Remote Code Execution (RCE) interface. There is no evidence of intentional malice or hidden exfiltration logic, but the inherent risk of shell access and the potential for blacklist bypasses via shell syntax or unlisted commands warrant a suspicious classification.