Version Drift Publish

One command to check if your entire stack is up to date. SSHes into servers, queries APIs, and compares installed versions against latest — across every serv...

This skill is coherent with its stated purpose, but it is powerful: it will run arbitrary shell commands locally and over SSH and will issue HTTP requests to any URL you configure. Before you install or run it: (1) review config.yaml carefully — any command in 'installed' will be executed; (2) keep secrets minimal and put them in environment variables with least-privilege tokens (the script will expand and use any ${VAR} you reference); (3) prefer a non-root SSH user with read-only permissions where possible; (4) be aware it writes a state file (state.json) in the working directory; (5) consider running first in a sandbox or CI runner with limited credentials; (6) if you need stronger SSH host verification, explicitly set strict_host_key in your config instead of using the default accept-new. If you want further checks, provide the full drift.py for deeper code review (the supplied snippet is large but truncated in places).

Type: OpenClaw Skill Name: version-drift Version: 1.2.1 The bundle provides a version-tracking utility that utilizes high-risk primitives, specifically arbitrary local shell execution via 'sh -c' and remote execution via SSH in drift.py. While these capabilities are aligned with the tool's stated purpose of checking software versions across a stack, the script lacks input sanitization for commands defined in config.yaml, creating a direct path for Remote Code Execution (RCE). No evidence of intentional malice, data exfiltration, or hardcoded backdoors was found, but the broad execution surface on both the local host and remote servers justifies a suspicious classification.