Вконтакте - публикация постов, фото и видео. Диалоги с посетителями. NodeJS

Manage VK.com (Vkontakte) community: post content (text, photos, videos) and handle messages. Use for automating community management via VK API.

This skill appears to be a straightforward VK CLI for community management, but stop and consider these points before installing or running it: - The skill requires a VK Access Token (a 'User Token' with wide scopes). This is sensitive — treat it like a password. The package metadata does not declare this requirement, so don't assume the skill will protect or store your token safely. - Passing the token as a command‑line argument (the examples do this) exposes it to process listings and shell history. Prefer providing the token via a secure environment variable, a file with restricted permissions, or other safer means. - The documentation suggests using a third‑party site (vkhost.github.io) to obtain a permanent token. Verify the trustworthiness of any external token provider before entering credentials — better to create your own app or use official dev.vk.com flows if possible. - Review scripts/vk_cli.js yourself (or run it in an isolated environment) to confirm it only talks to api.vk.com and VK upload URLs; there is no obfuscation, but you should verify network destinations and test with a least‑privilege token first (community token) where feasible. - Because the manifest omitted the required credential declaration, be cautious: ask the publisher (or avoid installing) until the metadata accurately lists the required token and scopes. If you proceed: run in a sandboxed environment, use a token with minimal scopes you need, avoid CLI token arguments, and verify the token provider and code before giving it full administrative (User Token) credentials.

Type: OpenClaw Skill Name: vk Version: 1.0.2 The skill is classified as suspicious due to its requirement for a highly privileged and permanent VK User Token (with `wall,groups,photos,video,messages,offline` scopes) and its direct file system and network access capabilities, even though these are plausibly needed for its stated purpose of VK community management. While the code itself (`scripts/vk_cli.js`) and documentation (`SKILL.md`, `references/api.md`) do not show clear evidence of intentional malicious behavior or prompt injection attempts against the agent, the broad permissions and access granted by the skill present a significant risk if the agent or token were compromised or misused.