SetupOrion ByImpa

Setup completo de VPS Ubuntu/Debian para produção com Docker Swarm, Traefik v3 (SSL/HTTPS automático), Portainer CE e rede overlay. Baseado no SetupOrion v2.8.0. Executa todos os comandos automaticamente.

This SKILL.md is a full automated VPS setup that will run many root-level commands and requires you to supply admin passwords and API keys. Before running it: 1) Review the entire SKILL.md yourself — don't blindly pipe commands into a shell. 2) Note the registry metadata omitted the env vars that the script expects; prepare the required secrets locally and do not paste them into untrusted places. 3) Prefer running the steps manually or in a controlled staging VM first so you can inspect files (traefik.yaml, docker stacks) before they are applied. 4) Be cautious of the curl | bash Docker installer — if you want safer review, install Docker via your distro packages or inspect the installer script first. 5) Back up the server, and ensure DNS and Let's Encrypt limits are understood. If you don't trust the skill's unknown source/homepage, treat it as untrusted instructions rather than an approved package.

Type: OpenClaw Skill Name: setuporion-byimpa Version: 1.0.0 The skill is classified as suspicious due to several significant security vulnerabilities, primarily the use of `curl -fsSL ... | bash` in `SKILL.md` (Etapa 2), which executes arbitrary remote code and poses a high RCE risk. Additionally, the script repeatedly uses `curl -k` (e.g., Etapa 7, Etapa 9) to disable SSL certificate verification when handling sensitive credentials like the Portainer admin password and Evolution API key, making these communications vulnerable to Man-in-the-Middle attacks. Sensitive credentials are also echoed to stdout, posing a risk if logs are not properly secured. While these are serious flaws, there is no clear evidence of intentional malicious behavior such as data exfiltration to unauthorized endpoints or backdoor installation, indicating vulnerabilities rather than outright malice.