Security audit
Security checks for vulnerabilities and agentic risk
This skill is mostly coherent, but it can create persistent platform-connection skills and may record authentication configuration without clear safeguards against saving secrets.
Review this skill before installing if you use it for accounts, APIs, or CLIs. Do not let generated skills store raw tokens, private keys, session cookies, full auth headers, or sensitive account details; require a preview of any files written under ~/.openclaw/skills/ and keep credentials in a proper secret store or environment variable reference.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
### 基本信息
- 官网：https://github.com
- 类型：代码托管平台
- 认证方式：Personal Access Token (PAT)
### 技术文档
- API：https://docs.github.com/rest
The skill covers authentication setup for plugins, CLI tools, and APIs, but it does not warn users about handling API keys, OAuth tokens, SSH keys, or other secrets. This omission increases the chance that users will paste credentials into chat, store them insecurely, or allow them to be embedded in scripts or generated skills.
The skill instructs creating directories and files under ~/.openclaw/skills/ after a successful link, but it does not explicitly warn the user that this modifies the local filesystem or require a separate consent step for the write operation itself. In an agent setting, undocumented writes to user home directories can surprise users, create persistence, and normalize unsafe file creation behavior.
The instruction to record the complete connection scheme, including authentication method and configuration parameters, into a reusable skill creates a strong risk that secrets or sensitive setup details will be persisted. In this context, the danger is elevated because the skill's whole purpose is platform linking, so credentials and connection metadata are central to its workflow.
The example success report includes user identity and authentication state, which normalizes echoing account and auth details back into chat or logs. While not always catastrophic, this can leak sensitive operational information to shared transcripts, logging systems, or unintended viewers.
All user-facing instructions, prompts, and examples are in Chinese, including required reply options like "要" / "不要". This effectively imposes a language/locale expectation without user opt-in or a documented reason that the skill is region-specific.