ClawHub

CAPTCHAS OpenClaw

v1.0.1

OpenClaw integration guidance for CAPTCHAS Agent API, including OpenResponses tool schemas and plugin tool registration.

⭐ 2· 2k·4 current·4 all-time
by@captchasco
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (CAPTCHAS integration) aligns with declared env vars (CAPTAS_API_KEY, CAPTCHAS_ENDPOINT) and the API endpoints referenced. Requested credentials and endpoint are expected for this integration.
ℹ
Instruction Scope
SKILL.md contains only API integration guidance and tool schemas. It does not instruct the agent to read unrelated system files or other credentials. Note: the 'signals' parameter is free-form (additionalProperties allowed) and the doc warns to avoid PII but does not enforce it — this is a possible data-exposure risk if callers put sensitive user data into signals. The example plugin's execute() simply returns JSON.stringify(params), which in a real integration could cause sensitive inputs to be reflected into tool output/logs.
✓
Install Mechanism
Instruction-only skill with no install spec and no code files — lowest-risk install posture; nothing is written to disk or downloaded by the skill itself.
✓
Credentials
Only two environment variables are required: CAPTCHAS_API_KEY (primary credential) and CAPTCHAS_ENDPOINT. Both are appropriate and necessary for an API integration; no unrelated credentials or broad config paths are requested.
✓
Persistence & Privilege
Skill is not always-enabled and does not request system-wide privileges or attempt to modify other skills. Default autonomous invocation is allowed (platform default) but not combined with other concerning privileges here.
Assessment
This skill is coherent for integrating CAPTCHAS with OpenClaw. Before installing, store CAPTCHAS_API_KEY securely and confirm CAPTCHAS_ENDPOINT is correct. Be cautious about what you include in the 'signals' object — avoid PII or sensitive tokens, since the schema allows arbitrary fields. Replace the example execute() that echoes params before using in production (echoing inputs can leak sensitive data to logs or assistant outputs). Finally, ensure API keys are scoped/minimized and rotated regularly.

Like a lobster shell, security has layers — review code before you run it.

latestvk973c6t50p25zy9y8aw044tcbx80ncd5

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🧩 Clawdis
EnvCAPTCHAS_API_KEY, CAPTCHAS_ENDPOINT
Primary envCAPTCHAS_API_KEY

Comments