Virtual Box Manager

Control and manage VirtualBox virtual machines directly from openclaw. Start, stop, snapshot, clone, configure and monitor VMs using VBoxManage CLI. Supports...

This skill appears to do what it claims: it runs VBoxManage commands to manage VMs and does not request unrelated secrets or installs. Before installing, ensure VBoxManage/VirtualBox is installed and that you run the skill under an account with only the necessary local privileges. Be cautious with inputs you provide to the skill (VM names, paths, descriptions, ports) because the helper uses shell execution (child_process.exec) and could be vulnerable to command injection if given untrusted strings—avoid passing untrusted or unsanitized input. Note also an optional VBOXMANAGE_PATH environment variable can override the binary path; if you want to lock behavior, set or audit that environment variable. If you need stronger guarantees, review the scripts/virtualbox-utils.ts code or run the skill in a restricted environment.

Type: OpenClaw Skill Name: virtualboxmanager Version: 0.0.1 The skill bundle is classified as suspicious due to a critical shell injection vulnerability in `scripts/virtualbox-utils.ts`. The `vboxCommand` function directly interpolates user-controlled arguments into `child_process.exec` calls without proper sanitization or escaping. This flaw allows an attacker to inject arbitrary shell commands, potentially leading to remote code execution on the host system where the OpenClaw agent is running. While this is a severe vulnerability, there is no clear evidence of intentional malicious behavior (e.g., data exfiltration, backdoor installation) within the provided code, aligning it with a 'suspicious' classification rather than 'malicious'.