System Commander

Convert user tasks to optimal Linux/Python commands. Use when user needs file processing, data extraction, text manipulation, or any task that can be solved...

This skill is coherent with its goal of translating tasks into system commands, but exercise caution before letting it execute anything automatically. Key points to consider: - The skill often produces shell commands that can modify or delete files (sed -i, mv, find + exec-like patterns). Always review commands and prefer dry-runs before executing. - The translate.py code injects user-supplied parameters directly into command strings. If you allow the agent to run commands (code_execution), that can lead to accidental destructive actions or exposure of sensitive files. Prefer disabling automatic execution or require explicit confirmation from a human for any command that writes/deletes/renames files. - The Python snippets in translate.py contain formatting bugs and unsanitized string interpolation (e.g., malformed f-strings and subprocess.run usage). These indicate sloppy engineering — not necessarily malicious, but they increase the chance of unexpected behavior. - If you want to use this skill safely: restrict it to generating commands (no automatic execution), require an explicit human approval step for every command that modifies state, run commands in a sandboxed environment when possible, and ask the skill author for input-sanitization and dry-run defaults. - Confidence would increase if the author documents whether the skill ever executes commands autonomously (it appears intended only to generate commands) and if translate.py is fixed to avoid string-injection risks and syntax errors.

Type: OpenClaw Skill Name: system-commander Version: 1.0.0 The 'system-commander' skill facilitates the execution of arbitrary shell and Python commands by the AI agent, which is a high-risk capability. The helper script `scripts/translate.py` contains a significant command injection vulnerability because it uses unsanitized user input to format command strings within the `PATTERNS` dictionary (e.g., using `.format(**params)` for bash and python templates). While the skill's stated purpose is token efficiency and file processing, the lack of input sanitization and the encouragement of direct system-level execution without safety checks pose a high risk of Remote Code Execution (RCE).