Secure password generator with multiple modes. Generate strong random passwords with customizable length, create numeric PINs, build memorable passphrases fr...
Security Analysis
high confidenceThe skill mostly matches its stated purpose (a local password generator) but contains unsafe string interpolation between shell and embedded python (possible command/injection and quoting issues) and a small metadata mismatch (python3 required but not declared).
The name/description align with the included script: generate/pin/phrase/check are implemented. Minor mismatch: the runtime implementation invokes python3, but the skill metadata declares no required binaries. Also SKILL.md lists version 1.0.0 while registry shows 1.0.2.
The runtime script executes embedded python via python3 -c with direct interpolation of shell variables into the python code. In cmd_check the password is embedded as pw='$pw' inside a double-quoted python command — a password containing single quotes, newlines, or other special characters can break quoting and enable code injection or unexpected behavior. Similarly, numeric parameters ($len, $count, $words) are interpolated without validation, which could cause errors or unexpected code execution if non-numeric input is passed. The SKILL.md instructions themselves are scoped to password generation, but the implementation's unsafe interpolation is a vulnerability.
No install spec and no external downloads — instruction-only plus a small shell script. This minimizes installation risk.
The skill requests no environment variables, credentials, or config paths — consistent with a local password generator.
always is false and the skill does not request elevated/persistent privileges or modify other skills' configs.
Guidance
This skill appears to be a straightforward local password generator, but review and fix the included script before use. Specific concerns: - The script requires python3 at runtime but the skill metadata doesn't declare python3 as a required binary — ensure your environment has python3. - The check and generation commands embed user input directly into python -c strings (e.g., pw='$pw'), which can break quoting and enable code injection if a password contains single quotes or other special characters. Do not run this script on untrusted machines or with secrets you can't afford to expose until it is fixed. - Recommended fixes: avoid interpolating data into -c code; instead pass values via command-line arguments (python3 -c 'import sys; pw=sys.argv[1]' -- "$pw") or read from stdin, and validate/sanitize numeric parameters. Also update the skill metadata to declare python3 as required. - If you are not comfortable editing the script, consider using a well-audited password manager or generator instead.
Latest Release
v1.0.2
Standards compliance: unique content, no template text
More by @xueyetianya
Published by @xueyetianya on ClawHub
