Skill: sadikjarvis/native-run (version 0.0.1)

# Native Run ## Overview Native Run is an OpenClaw skill that allows executing native commands on the local machine where the OpenClaw gateway is running. This skill is useful for automation, testing and local tooling. ## What this skill does - Executes native commands - Returns output back to OpenClaw - Runs only on the local gateway machine ## Usage Send a message that matches the configured pattern. Example: Run native: whoami ## Platform Windows ## Security notice This skill can execute local commands. Use only in a trusted environment.

path: native_run.py
content: # native_run.py – a tiny HTTP server that runs shell commands
# Put this next to skill.md / task.yml

import http.server
import json
import subprocess
from urllib.parse import urlparse, parse_qs

# ---------------------------------
PORT =  8080                      # matches the URL you hit from your WA/webchat
[REDACTED_SECRET]"     # keep the same token you used in the earlier snippet
# ---------------------------------

class Handler(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        # Health‑check endpoint
        self.send_response(200)
        self.end_headers()
        self.wfile.write(b"native-run online")


    def do_POST(self):
        # Verify the token
        qs = urlparse(self.path).query
        if parse_qs(qs).get("token", [None])[0] != [REDACTED_SECRET])
            self.end_headers()
            self.wfile.write(b"Forbidden")
            return

        # Grab the JSON body
        length = int(self.headers["Content-Length"])
        payload = json.loads(self.rfile.read(length))

        if not payload.get("task") == "native_run" or "command" not in payload:
            self.send_response(400)
            self.end_headers()
            self.wfile.write(b"Bad Request")
            return

        # Run the command
        try:
            output = subprocess.check_output(
                payload["command"],
                shell=True,
                stderr=subprocess.STDOUT,
                text=True,
            )
        except subprocess.CalledProcessError as e:
            output = f"❌ {e.output}"

        self.send_response(200)
        self.end_headers()
        self.wfile.write(output.encode())

if __name__ == "__main__":
    httpd = http.server.HTTPServer(("localhost", PORT), Handler)
    print(f"✅  Running native runner on http://localhost:{PORT}")
    httpd.serve_forever()

path: native_run_skill.js
content: // native_run_skill.js – hand-off to the native runner endpoint
const axios = require('axios');

module.exports = async function (input, context) {
  const raw = context.message || '';
  const command = raw.replace(/^Run command:\s*/i, '').trim();

  if (!command) return '❌ No command provided.';

  try {
    const resp = await axios.post(
      'http://localhost:8080/?[REDACTED_SECRET]',
      { task: 'native_run', command }
    );
    return resp.data;
  } catch (e) {
    if (e.response) return `❌ ${e.response.statusText}:${e.response.data}`;
    return `❌ ${e.message}`;
  }
};


path: skill.json
content: name: native_run
version: 0.0.1
main: skill.js

path: tasks.yaml
content: name: native_run
description: Run an arbitrary command
# The “skill” is effectively a single HTTP call made by the skill entry point defined in the agent (see below)
task:
  command: # placeholder – the skill entry point will inject this from the chat message
  output: # optional processing or formatting

Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (CRITICAL)