Terminal Executor

Execute terminal commands with optional sudo privileges and return the command output safely upon user request.

Security Scan

The skill does what it claims — it executes arbitrary shell commands (including via sudo) — and its code and instructions are internally consistent, but it grants powerful capabilities that carry real risk if misused.

Purpose & Capability

Name, description, SKILL.md, and included code (exec and sudo_exec) all align: the skill exists to run terminal commands and provide outputs. There are no unrelated environment variables, external downloads, or unexpected capabilities declared.

Instruction Scope

SKILL.md and the code allow execution of arbitrary shell commands and sudo-prefixed commands. This is within the declared purpose, but the instructions rely on the agent/user to confirm sensitive actions (no programmatic confirmation enforcement). Returned command output may contain secrets or sensitive system information; the skill does not sanitize or limit outputs.

Install Mechanism

No install spec or external downloads; the skill is instruction/code-only and uses local Node.js modules. Nothing is written to disk beyond the provided files.

Credentials

The skill requests no credentials or config paths, which matches its purpose. However, child processes inherit process.env (the code passes process.env to commands), so executed commands can read environment variables and local files — a natural capability for any command runner but a privacy/safety concern in practice.

Persistence & Privilege

always is false and the skill does not request persistent system changes or modify other skills. It does allow autonomous invocation (platform default), which combined with arbitrary command execution is a runtime risk but is not unusual for this category of skill.

Assessment

This skill legitimately runs arbitrary shell commands (including prefixed with sudo). Before installing, confirm you trust the author and environment where it will run. Consider: 1) avoid running the skill with sensitive account access or secrets available in the environment; 2) require explicit human confirmation before any destructive or privileged commands — the skill's docs suggest this but do not enforce it; 3) review the code (tools/exec.js and tools/sudo_exec.js) and, if possible, run in a sandbox or VM first; 4) be aware that command output may leak secrets or system data, and sudo commands may prompt for credentials or fail silently. If you need stricter controls, prefer a wrapper that enforces command whitelisting and explicit confirmations.

terminal-executor - 终端命令执行器

描述

执行终端命令并返回结果，支持sudo权限命令。

激活时机

当用户需要执行系统命令、安装软件、检查系统状态等终端操作时激活。

工具

• exec: 执行终端命令
• sudo_exec: 执行需要sudo权限的命令

使用示例

1. 检查系统信息: exec("uname -a")
2. 安装软件: sudo_exec("apt install -y package")
3. 查看进程: exec("ps aux | grep process")

安全注意事项

• 谨慎执行删除、格式化等危险命令
• 需要用户确认敏感操作
• 记录执行历史