wallpaper-auto-switch-pro-executable

在 macOS 本机从本地壁纸文件夹中立即换壁纸，或安装 launchd 定时轮换任务的可执行技能。

This skill largely matches its description, but take these precautions before running or installing: 1) Fix the shuf/gshuf mismatch — either install GNU coreutils (providing gshuf) or edit scripts to call the correct shuf binary on your system. 2) Inspect and (preferably) edit common.sh's expand_path() to avoid eval; use a safe expansion method (e.g., expand ~ without eval) to eliminate command-injection risk from untrusted path strings. 3) Run list_images.sh first to verify it finds only intended files. 4) Be aware install_launchagent.sh will create ~/Library/LaunchAgents/com.openclaw.wallpaperrotator.plist and start a per-user launchd job; uninstall_launchagent.sh will remove that plist. 5) When scripts call osascript, macOS may prompt for automation accessibility permissions; review prompts before granting. If you cannot audit or modify the scripts yourself, avoid installing the LaunchAgent and run rotate_once.sh manually with a trusted, simple path to minimize risk.

Type: OpenClaw Skill Name: wallpaper-auto-switch-pro-executable Version: 1.0.0 The skill automates macOS wallpaper rotation using local bash scripts and launchd for persistence. It contains a shell injection vulnerability in `scripts/common.sh` where the `eval` command is used to expand tilde (~) paths without input sanitization, potentially allowing arbitrary command execution if a malicious path is provided. While the functionality aligns with the stated purpose and no evidence of intentional malice or data exfiltration was found, the insecure handling of path inputs poses a significant security risk.