Unexpand Tool
PassAudited by VirusTotal on May 6, 2026.
Overview
Type: OpenClaw Skill Name: unexpand-tool Version: 1.0.0 The script scripts/unexpand.py contains a significant logic error and vulnerability where it attempts to use the entire content of stdin as a filename for open() if no command-line arguments are provided. Furthermore, the implementation is highly incomplete and does not support any of the flags (e.g., -t, -a) documented in SKILL.md, which could lead to unexpected behavior or unintended file access if an agent passes untrusted input through a pipe.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A piped text input could be misinterpreted as a local file path, causing the tool to fail or display the contents of an unintended file.
When no filename argument is supplied, the script reads stdin and uses that text as a file path, while SKILL.md documents piped text input. This is more likely a bug than malicious behavior, but users should avoid piping untrusted content.
open(sys.argv[1] if len(sys.argv)>1 else sys.stdin.read()).read()
Use explicit intended filenames and fix stdin handling before relying on piped-input workflows.
The skill may not run as documented, or a local command with the same name could be used instead of the included script.
The documentation references an unexpand-tool command and the manifest includes scripts/unexpand.py, but no install mechanism declares how that command is provided.
No install spec — this is an instruction-only skill.
Verify the command path or wire the included script explicitly before use.