tulisai

Use when managing BangunAI Blog content, automating blog workflows, and writing MDX articles with BangunAI conventions. Supports Obsidian-like features (callouts, mermaid, LaTeX, wikilinks, backlinks, graph view).

This skill appears to be what it says: a local BangunAI blog content manager. Before installing or allowing it to run autonomously, check these points: 1) Confirm the BLOG_ROOT path — SKILL.md uses an absolute path (/home/hades/BangunAI-Blog). If your blog is elsewhere, update the path or run in a safe test workspace. 2) Back up your repo (git commit / branch) — example scripts use 'cat >' (which overwrites files) and 'git rm' (deletes tracked files). 3) If you permit autonomous execution, restrict the agent so it must ask before running any destructive commands, or review suggested shell commands before execution. 4) There are no external network calls or credential requests, but the skill will modify local files — treat it like any automation that writes to your repo. If you want higher assurance, run the example scripts manually the first time in a disposable copy of your project.

Type: OpenClaw Skill Name: tulisai Version: 0.1.0 The skill's primary purpose is benign, focusing on managing blog content within a defined directory (`/home/hades/BangunAI-Blog`). However, several shell scripts in SKILL.md and EXAMPLES.md exhibit potential shell injection vulnerabilities. Specifically, the `read` workflow uses `find ... -name "*$FILE*.mdx" | xargs -r cat` and the `Search for Keyword` example uses `find ... -exec grep -l "$KEYWORD" {} \;`. If `$FILE` or `$KEYWORD` are derived from unsanitized user input, an attacker could craft malicious input to execute arbitrary commands, leading to a Remote Code Execution (RCE) risk. While there's no clear evidence of intentional malice (e.g., data exfiltration, backdoors), these vulnerabilities make the skill suspicious.