Clash Controller

This skill mostly does what it says (controls Clash via the local REST API) but you should be cautious before installing: - The repository contains a hard-coded API secret. That secret is sent to the local controller; remove or replace it and instead configure the skill to read your actual Clash external-controller secret from the config file or from an environment variable. - SKILL.md mentions starting/stopping the Clash process and reading the config file, but the code does not do process control or file reads — expect only REST API calls. If you need process control, request or review additional code. - Test on a non-production machine first: enable External Controller in Clash, verify the controller host/port/secret, and try the skill locally. - If you do not want any reusable tokens stored in the skill, edit skill.js so it reads the secret from an environment variable (or from the local config) rather than using the baked-in token. - Because the skill communicates with a local service using an auth token, ensure the token in your Clash config is private and the machine is secure; the skill does not appear to exfiltrate data externally, but exposing any token in a public registry is a privacy risk. If you want higher assurance, request the author to remove hard-coded secrets and to document exactly how the skill obtains the correct secret (env var or config path) and whether it requires OS-level process control and how that will be implemented.