系统命令

• Outcome: Review
• Latest audit: May 28, 2026 · 2:24 PM UTC
• Version: 1.0.0

Overview

This is a disclosed Windows command skill, but it gives an agent broad host shell execution while describing parts of that access as safer or more restricted than they are.

Install only if you intentionally want OpenClaw to run Windows shell commands with the privileges of the hosting process. Review aliases before use, avoid inline passwords, treat outputs as sensitive, and do not use `--yes` or redirection unless you are prepared for file writes, process termination, service changes, or other system impact.

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The README explicitly claims command execution is restricted to a predefined safe allowlist, but later documents command chaining ("&&") and output redirection (">"), which are classic shell metacharacter features used to escape allowlist intent and execute arbitrary shell behavior. In a system-command skill, this contradiction strongly suggests the effective interface may permit broader command execution than the safety model claims, enabling unauthorized command execution or file write side effects.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The documentation frames the skill as limited to read-only diagnostics and safe commands, yet it includes state-changing capabilities like taskkill and task-related operations that can terminate processes or affect system behavior. Misrepresenting destructive operations as benign lowers operator caution and increases the chance of misuse or unsafe delegation to the agent.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The documentation is internally contradictory: it states that only predefined safe commands are allowed, while elsewhere it explicitly supports `/system_cmd exec <命令>` and even confirmed execution of destructive commands with `--yes`. That mismatch is dangerous because it can mislead reviewers, operators, or downstream policy systems into trusting a skill that effectively exposes broad command execution on the host.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The help text claims custom commands run in a 'restricted environment', but the implementation directly invokes user-supplied input through cmd.exe or PowerShell on the host via exec(). This is dangerous because users or upstream agents may trust the safety claim and submit commands that execute with the host process privileges, increasing the chance of accidental or unsafe host-level command execution.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The skill advertises permission control and safety, but still exposes arbitrary shell execution through `executeCustomCommand`, protected only by a narrow blacklist and a user-controlled `--yes` confirmation. In an agent context, this is dangerous because attackers can supply harmful commands not covered by the blacklist, turning the tool into a general-purpose command execution primitive.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The help text presents aliases as safe/direct shortcuts, but config-defined aliases can resolve to arbitrary shell commands and then flow into executeCustomCommand. This creates a misleading trust boundary: users may invoke an alias believing it is safe while it can execute any command permitted by the host shell, including commands not covered by the limited blacklist/high-risk checks.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The quick-start documentation encourages use of commands like ipconfig, netstat, tasklist, and systeminfo without warning that their output may contain sensitive host, network, and process details. This can lead users to unintentionally expose internal IPs, hostnames, installed software, running security tools, or network connections in chat transcripts, logs, or shared screenshots.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: Documenting taskkill as a normal supported command without an immediate, prominent warning obscures that it can terminate critical processes and cause denial of service, data loss, or instability. In an agent skill context, users may treat documented commands as safe defaults, so under-warning a destructive action materially increases operational risk.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill is designed to run commands like `ipconfig /all`, `tasklist`, `netstat -an`, and `systeminfo`, all of which can reveal sensitive host, user, process, and network information. In an agent environment, returning this data to the user or model without clear privacy gating can enable reconnaissance, expose internal topology, and leak environment details useful for follow-on attacks.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The examples explicitly show commands and sample outputs that disclose potentially sensitive host, network, and environment details such as hostnames, internal IP addresses, listening ports, process lists, domain/workgroup membership, and OS/build information. Even though this is documentation rather than executable code, the skill encourages collection and display of reconnaissance data without clearly warning about privacy, redaction, or safe-sharing practices, which can lead to inadvertent exposure in chats, logs, screenshots, or support transcripts.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

// 危险命令黑名单（完全禁止执行）
const FORBIDDEN_COMMANDS = [
  'rm -rf', 'del *.*', 'format c:', 'format d:', 'format e:', 'format f:',
  'reg delete HKLM', 'reg delete HKCU',
  'net user administrator', 'net localgroup administrators'
];

• Confidence: 96% confidence
• Finding: The presence of a forbidden-command blacklist indicates the tool accepts attacker-influenced command strings and tries to filter dangerous inputs by substring matching. Blacklists are easy to bypass with alternate syntax, encoding, command chaining, PowerShell features, or simply using destructive commands not listed, so the underlying issue is uncontrolled shell command execution.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

/^sc\s+delete/i,               // sc delete
  /^reg\s+delete/i,              // reg delete
  /^shutdown\s+[\/\-]/i,         // shutdown /s
  /rm\s+-rf/i                    // rm -rf
];

// 完全禁止的命令模式

• Confidence: 95% confidence
• Finding: The regex-based high-risk detection for patterns like `rm -rf` is not a sufficient defense because it only labels some commands as requiring confirmation, rather than preventing arbitrary command execution. An attacker can reformulate destructive actions in ways the regex does not match or use different interpreters and syntax, resulting in command execution with significant system impact.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

// 完全禁止的命令模式
const FORBIDDEN_PATTERNS = [
  /rm\s+-rf\s+[\/\\]/i,          // rm -rf /
  /del\s+\*\.\*\s+[\/\\]/i,      // del *.* /
  /format\s+[cdefg]:\s+\/y/i,    // format c: /y
  /reg\s+delete\s+HKLM/i,        // reg delete HKLM

• Confidence: 95% confidence
• Finding: The forbidden regex for `rm -rf /` exemplifies a brittle denylist approach that blocks only a few exact destructive forms while leaving many equivalent variants available. Because the tool ultimately executes raw command text via CMD or PowerShell, bypassing these patterns can lead to deletion, service disruption, data loss, or broader host compromise.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

/^format\s+[cdefg]:/i,         // format c:
  /^taskkill\s+\/f/i,            // taskkill /f
  /^net\s+stop/i,                // net stop
  /^sc\s+delete/i,               // sc delete
  /^reg\s+delete/i,              // reg delete
  /^shutdown\s+[\/\-]/i,         // shutdown /s
  /rm\s+-rf/i                    // rm -rf

• Confidence: 94% confidence
• Finding: Flagging `reg delete` as high-risk demonstrates the tool permits registry-modifying commands after optional confirmation, which is unsafe in an agent-exposed skill. Registry modification can disable security controls, establish persistence, or damage system functionality, and the current pattern checks are too narrow to safely govern such operations.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

/^taskkill\s+\/f/i,            // taskkill /f
  /^net\s+stop/i,                // net stop
  /^sc\s+delete/i,               // sc delete
  /^reg\s+delete/i,              // reg delete
  /^shutdown\s+[\/\-]/i,         // shutdown /s
  /rm\s+-rf/i                    // rm -rf
];

• Confidence: 93% confidence
• Finding: Flagging `shutdown` as high-risk still allows an attacker to invoke system shutdown or reboot after simple confirmation, enabling denial of service and interruption of user work. In an agent tool, confirmation embedded in the same command flow is not a robust security control, especially if the caller can influence both command text and confirmation flag.

Static analysis

No suspicious patterns detected.