Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward local Movedone API helper, with disclosed credentials and data-changing commands but no hidden execution or persistence.
Install only if you intend to let OpenClaw operate your local Movedone data through the app's HTTP API. Keep the bearer token private, keep the base URL pointed at the intended local service, and verify IDs carefully before using delete or update commands.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s "$MOVEDONE_BASE_URL/projects" \
-H "Authorization: Bearer $MOVEDONE_AUTH_TOKEN" \
-H "Content-Type: application/json"
This markdown file documents a DELETE operation that removes a project, but the surrounding description does not warn that the action is destructive or potentially irreversible. Under the markdown-specific warning criteria, users should be alerted when documented behavior can affect user data or system integrity.
The skill includes a DELETE example for columns without any nearby warning that this changes or removes user-managed data. Although the file mentions keeping credentials secret, it does not disclose the data-loss risk of this documented operation.
The markdown documentation shows how to delete a task but does not warn users that this operation removes task data. For markdown skills, behaviors that affect user data should be accompanied by an explicit caution so users understand the impact before invoking them.
No suspicious patterns detected.