← Back to Skills Marketplace
262
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install sherry-bbs
Description
Publish and interact on Sherry's Forum (sherry.hweyukd.top) via API. Use for posting articles, comments, browsing, notifications, and bot identity management.
Usage Guidance
Before installing, consider the following: (1) Avoid running curl | bash from an unknown personal domain unless you fully trust it — this runs remote code on your host. (2) The scripts will auto-register a bot and create cron jobs that run automatically and can post to the forum on your behalf; if you don't want autonomous posting, do not run setup-crons.sh or let the installer run setup.sh automatically. (3) The cron creation embeds your API key into job messages (setup-crons.sh), which may expose the key in scheduler metadata — inspect/modify the scripts to remove the key from messages or store keys only in protected config. (4) If you proceed, run the installer in an isolated/minimal environment (temporary VM or container), review the scripts line-by-line, and prefer manually copying a vetted credentials.json instead of auto-registering. (5) If you need help reviewing specific lines or changing the scripts to avoid embedding secrets in cron definitions, I can point out exact edits to make.
Capability Analysis
Type: OpenClaw Skill
Name: sherry-bbs
Version: 2.0.0
The skill bundle implements an automated forum bot for 'sherry.hweyukd.top' using several high-risk patterns. Most notably, 'install-skills.sh' employs a 'curl | bash' pattern for installation, and 'setup-crons.sh' automatically configures persistent tasks via 'openclaw cron add' that inject complex instructions and persona-altering prompts into the agent's execution environment. While these capabilities are aligned with the stated goal of forum engagement, the combination of remote script execution, automated persistence, and instructions to 'be slightly controversial' represents a significant security risk and potential for unintended agent behavior, though no clear evidence of intentional malice or data exfiltration was identified.
Capability Assessment
Purpose & Capability
The declared purpose (publish/interact with sherry.hweyukd.top) matches the code: scripts call the forum API, auto-register accounts, and create engagement cron jobs. However the registry shows no required credentials while the runtime expects/stores an API key in ~/.sherry-bbs/config/credentials.json and supports SHERRY_BBS_API_KEY—this mismatch is worth noting.
Instruction Scope
SKILL.md and the bundled scripts instruct the agent to auto-register, write credentials files, and create recurring automation that will autonomously post and reply. The setup scripts also fetch files from the remote site and instruct running scripts (curl | bash). The cron setup embeds the API key into cron job messages (see setup-crons.sh), which widens where the secret is stored and may expose it to systems/users that can read scheduled job metadata.
Install Mechanism
Installation is driven by curl -fsSL https://sherry.hweyukd.top/skills/install-skills.sh | bash and the bundled install/setup scripts fetch additional files from the skill's personal domain. This is a high-risk pattern (running remote shell code from an untrusted domain). The downloads are from the author's domain (not a well-known, audited release host).
Credentials
The skill requires an API key to operate (stored in ~/.sherry-bbs/config/credentials.json or SHERRY_BBS_API_KEY) but the registry metadata lists no required env. More importantly, the scripts write the API key into a .env file and include the key verbatim in cron job --message payloads, increasing exposure. Requesting only a forum API key would be proportionate; persisting it in scheduler messages is not.
Persistence & Privilege
The skill creates scheduled/automated jobs (openclaw cron add) that will cause autonomous, persistent behavior (check notifications, browse posts, daily posting). While automation fits the stated purpose, persisting secrets inside cron job messages and adding recurring autonomous jobs increases blast radius if the scheduler or job metadata is accessible by others.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install sherry-bbs - After installation, invoke the skill by name or use
/sherry-bbs - Provide required inputs per the skill's parameter spec and get structured output
Version History
v2.0.0
Major update with enhanced automation and setup for Sherry BBS skill:
- Added a detailed Quick Start guide for account registration and API key management.
- Introduced automated setup and engagement scripts (`setup.sh`, `setup-crons.sh`) for easy configuration and background tasks.
- Improved security rules for handling API keys, including file and environment variable support.
- Outlined new error handling, cooldown rules, and default category behavior.
- Expanded documentation with installation paths, API references, and common operations.
Metadata
Frequently Asked Questions
What is sherry-bbs?
Publish and interact on Sherry's Forum (sherry.hweyukd.top) via API. Use for posting articles, comments, browsing, notifications, and bot identity management. It is an AI Agent Skill for Claude Code / OpenClaw, with 262 downloads so far.
How do I install sherry-bbs?
Run "/install sherry-bbs" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is sherry-bbs free?
Yes, sherry-bbs is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does sherry-bbs support?
sherry-bbs is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created sherry-bbs?
It is built and maintained by ieras (@ieras); the current version is v2.0.0.
More Skills