专为百度秒哒应用打造的SecondMe OAuth2登录和API集成工具，完成Connect to SecondMe OAuth2接入

SecondMe Connect - 数字分身集成器。让百度秒哒应用轻松接入SecondMe生态，一键实现OAuth2登录和完整API调用。3步完成集成，开箱即用。

This package is coherent for its stated goal, but follow these safety checks before deploying: - Treat SUPABASE_SERVICE_ROLE_KEY and SECONDME_CLIENT_SECRET as highly sensitive: configure them only in server/Edge Function secrets (e.g., supabase secrets), never commit to source or expose to the frontend. - Rigorously test Row-Level Security (RLS) in your Supabase project: authenticate as different users and confirm SELECT/UPDATE only returns each user's own profile row. If RLS is misconfigured, stored access_tokens could be exposed. - Consider whether the frontend truly needs direct access to the raw SecondMe access_token. If possible, proxy API calls through the Edge Function (server-side) to avoid giving tokens to client code. - Configure ALLOWED_ORIGINS strictly (do not use '*'). Verify the getAllowedOrigins/CORS implementation behaves as you expect in your deployment environment. - Review Edge Function logs and the token-exchange endpoint usage (https://api.mindverse.com...) to ensure tokens are obtained and stored exactly as intended; confirm that the skill is calling the official SecondMe endpoints for your integration. - The registry metadata had a formatting bug for the env listing — rely on SKILL.md and the template files to understand required env vars. - Perform a light code review of the Edge Function's use of supabase.admin APIs (listUsers/createUser/generateLink) and ensure it matches your Supabase plan/ACLs and that magic-link behavior meets your security requirements (token lifetime, revocation). If you are not comfortable managing high-privilege keys or verifying RLS/CORS yourself, involve a developer or security engineer before deploying to production.

Type: OpenClaw Skill Name: secondme-connect-miaoda Version: 1.0.2 The skill bundle provides a legitimate OAuth2 integration for the SecondMe ecosystem into Supabase-based applications. It implements standard security practices, including CSRF protection using state parameters in 'LoginButton.tsx', whitelist-based CORS validation in the 'secondme-oauth-callback' Edge Function, and Row Level Security (RLS) for protecting user tokens in 'profiles.sql'. The documentation in 'SKILL.md' and 'INTEGRATION.md' explicitly highlights the risks of high-privilege keys (SUPABASE_SERVICE_ROLE_KEY) and provides clear instructions on secure configuration. No evidence of intentional malice, data exfiltration, or unauthorized execution was found.