Yanji Bus Query

查询延吉公交线路的实时车辆位置，可指定线路号、子线路及模糊匹配起始和终点站名。

This skill appears to implement the advertised bus-query functionality, but you should be cautious before running it: (1) the metadata omits required binaries — ensure curl and python3 are available; (2) the script embeds the remote JSON (and user-supplied station names) directly into an inlined Python program without escaping, which could allow arbitrary Python code execution if the remote site or inputs are malicious or if an attacker can tamper with the HTTP responses; (3) only use this skill if you trust the bus.yanjibus.com host or run it in an isolated/sandboxed environment. If you plan to install or run it, consider patching the script to avoid embedding untrusted data into source (e.g., pass BUS_DATA via stdin or a temporary file and use json.load, and safely escape or validate user inputs), and update the skill metadata to list required binaries.

Type: OpenClaw Skill Name: yanjibus Version: 1.0.0 The skill contains significant command injection vulnerabilities in `yanji-bus.sh`. User-provided arguments, such as station names and line numbers, are directly interpolated into a Python script block and shell commands without sanitization, which could allow for Remote Code Execution (RCE) if a user provides crafted input. While the tool's stated purpose of querying bus data from `bus.yanjibus.com` appears legitimate and there is no evidence of intentional malice, the implementation is highly insecure.