Site Cloner

This skill appears to implement a website cloner, but it contains several red flags you should consider before using it: - Hard-coded local paths and credentials: The instructions reference C:\Users\MJ\.openclaw\workspace and C:\Users\MJ\.ssh\vps_key and even a specific VPS IP (187.124.92.226) and GitHub user. Those are example values but could cause accidental use of your own keys/paths if run without careful review. - Implicit credential access: The skill will call ssh/scp and gh/git commands and expects an SSH key at a path. The skill metadata declares no credentials or config paths — that mismatch is concerning. If you run it, verify it will not read your ~/.ssh or any secret files, and never let it access keys you care about. - Undeclared required binaries: The metadata lists no required binaries, but the instructions require git, gh (GitHub CLI), ssh and scp and PowerShell's Invoke-WebRequest. Ensure these are present and that the agent will not run commands with elevated privileges automatically. - Network and data exfiltration risk: The skill downloads JS/CSS and mines strings — this can accidentally extract secrets or proprietary text. It also offers to push to a private GitHub repo and to upload files to remote VPS hosts; double-check destinations and consider using throwaway credentials or sandboxed systems. - What to ask the author or change before use: remove or parameterize any hard-coded paths/hosts, add explicit prompts and confirmations before accessing ~/.ssh or performing network pushes, declare required binaries and any env vars, and avoid embedding example real IPs/usernames. Prefer running this in a disposable VM/container and using a throwaway SSH key/GitHub repo for testing. If you do test it, run it offline or in a sandbox, replace example remote targets with safe test endpoints, and review every generated command before execution. If you are not comfortable auditing these operations, consider using well-known mirroring tools (wget --mirror, httrack) run by a human instead.