Unitconv

Convert units for length, weight, temperature, data, and speed. Use when switching measurement systems, sizing storage, or adjusting recipe quantities.

This skill appears to be a straightforward unit converter with no network calls or credential usage. Before installing, verify how the script will be invoked in your agent environment (SKILL.md expects a `unitconv` command but the repository provides scripts/script.sh), and confirm the platform will place or wrap that script on PATH or otherwise call it safely in a sandbox. If you want extra assurance, open and review scripts/script.sh (already included) — it contains only simple arithmetic and unit mappings. There are no obvious signs of exfiltration or unrelated capabilities.

Type: OpenClaw Skill Name: unitconv Version: 3.0.0 The skill contains a command injection vulnerability in the `calc` function within `scripts/script.sh`. User-provided input (the `<value>` argument) is passed directly into an `awk` command string without sanitization, which could allow an attacker to execute arbitrary shell commands. While the script's logic is consistent with its stated purpose as a unit converter and lacks evidence of intentional malice or data exfiltration, the lack of input validation poses a significant security risk.