Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
wallpaper-auto-switch-pro-executable
v1.0.0在 macOS 本机从本地壁纸文件夹中立即换壁纸，或安装 launchd 定时轮换任务的可执行技能。
⭐ 0· 203·0 current·0 all-time
byvx：17605205782@52yuanchangxing
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's name/description (macOS wallpaper rotator) matches the provided scripts and expected behavior: immediate rotation, listing images, installing/uninstalling a per-user launchd job. However there's an inconsistency in declared dependencies: metadata lists gshuf while the scripts call shuf. On macOS shuf is not present by default (Homebrew coreutils installs it as gshuf). This mismatch will likely cause runtime failures unless the user has the expected binary or adjusts the scripts.
Instruction Scope
The SKILL.md and scripts stay within the claimed scope (operate only on a user-specified directory, write plist to ~/Library/LaunchAgents, use osascript to set desktop picture, do not contact the network). However common.sh's expand_path() uses eval to expand input (eval "printf '%s' $input"), which can execute shell content if the provided path contains shell metacharacters—this is a command-injection risk if an attacker or a mistaken agent supplies a crafted directory string. The rest of the scripts avoid deleting user files and only write to user-scoped locations, as claimed.
Install Mechanism
This is an instruction-only skill with included scripts; there is no remote download or install routine. Nothing is fetched from external URLs or written to system-wide locations during 'install' beyond the user's LaunchAgents directory when the install script is run. That is lower risk than arbitrary downloads.
Credentials
The skill declares no environment variables or external credentials, which is appropriate. It uses $HOME and id -u for user-scoped operations, which is expected. The only proportionality issue is the binary name mismatch (gshuf vs shuf) between metadata/README and the actual scripts; the user may need to install GNU coreutils (gshuf) or modify scripts to call the available shuf/gshuf.
Persistence & Privilege
The skill does not request 'always: true' and will not be force-included. Its persistence comes from writing a LaunchAgent plist under the current user's ~/Library/LaunchAgents and using launchctl to bootstrap it — this is expected for a per-user automated task. The scripts only modify their own plist and user-scoped logs, not system-wide configuration or other skills.
What to consider before installing
This skill largely matches its description, but take these precautions before running or installing: 1) Fix the shuf/gshuf mismatch — either install GNU coreutils (providing gshuf) or edit scripts to call the correct shuf binary on your system. 2) Inspect and (preferably) edit common.sh's expand_path() to avoid eval; use a safe expansion method (e.g., expand ~ without eval) to eliminate command-injection risk from untrusted path strings. 3) Run list_images.sh first to verify it finds only intended files. 4) Be aware install_launchagent.sh will create ~/Library/LaunchAgents/com.openclaw.wallpaperrotator.plist and start a per-user launchd job; uninstall_launchagent.sh will remove that plist. 5) When scripts call osascript, macOS may prompt for automation accessibility permissions; review prompts before granting. If you cannot audit or modify the scripts yourself, avoid installing the LaunchAgent and run rotate_once.sh manually with a trusted, simple path to minimize risk.Like a lobster shell, security has layers — review code before you run it.
latestvk972wsxyqam3530mpdv0x2yk2x82s5sd
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🖼️ Clawdis
Binsbash, osascript, find, gshuf