Validator

Validate emails, URLs, phones, dates, and custom patterns. Use when sanitizing input, verifying form fields, checking formats, or enforcing rules.

This skill appears to do what it says: local validation plus optional network/DNS lookups. Before using it: (1) review or run the script locally from a trusted environment; (2) avoid passing real production secrets (full credit-card numbers, private files) unless you trust the runtime, because the tool will read and process whatever file or string you provide; (3) be aware that URL/domain commands will make outbound requests if curl/dig are available (which could reveal that you checked that host); (4) YAML validation attempts to import PyYAML if present — otherwise a basic fallback is used. If those behaviors are acceptable, the skill is internally coherent.

Type: OpenClaw Skill Name: validator Version: 3.0.1 The validator skill contains command injection vulnerabilities in the `json` and `yaml` commands within `scripts/script.sh`. Filenames are directly interpolated into `python3 -c` command strings, which could allow arbitrary code execution if an attacker can influence the names of files being validated. While the tool's logic appears functional and aligned with its stated purpose, these implementation flaws pose a significant security risk.