Mqtt Client

This is a simple client for connecting to an mqtt instance

Do not run this skill as-is against real brokers or with real credentials. Key concerns: (1) bootstrap.sh hardcodes a /home/jc/.openclaw/... path and activates a venv that may not exist; (2) the script sources an .env (not listed in required envs) and run.py reads MQTT_USERNAME and MQTT_PASSWORD—inspect that .env to ensure it doesn't contain secrets you don't want exposed; (3) run.py subscribes to all topics ('#') and logs message payloads to stdout (logs may be aggregated or retained); (4) requirements.txt lists paho.mqtt but there's no automated pip install—ensure dependencies are installed in an isolated environment. Recommended steps before installing: inspect or create the .env contents, replace hard-coded paths with relative or runtime-determined paths, add explicit install steps (pip install -r requirements.txt) or documentation, enumerate required env vars in the skill manifest, and run the client in an isolated environment (container or throwaway VM) connected to a test broker. If you need stronger assurance, ask the author to remove absolute paths, explicitly declare required env vars, and provide a proper install script that creates a venv and installs dependencies.

Type: OpenClaw Skill Name: mqtt-client Version: 1.0.7 The skill is classified as suspicious primarily due to the `source .env` command in `scripts/bootstrap.sh`. While intended for loading configuration, this command executes arbitrary shell commands found within the `.env` file. As the `.env` file is part of the skill bundle, a malicious skill developer could embed harmful shell commands (e.g., for data exfiltration or system modification) within it, which would then be executed by the agent. This represents a significant arbitrary code execution risk, even though the provided `run.py` script appears benign and uses environment variables for legitimate MQTT connection details.