SupportForge

AI customer support via SupportForge API — ticket creation, auto-replies, routing, knowledge base search. Use when user needs customer support automation, ti...

This skill appears to implement a customer-support API client, but there are several things to consider before installing: (1) the registry metadata does not list the required env vars (SUPPORTFORGE_API_KEY or SUPPORTFORGE_EMAIL and optionally SUPPORTFORGE_API_URL) — treat this omission as suspicious. (2) The bundle talks to and auto-signs up at anton.vosscg.com, a domain with no homepage or owner info in the registry entry; verify the vendor and confirm you trust that endpoint before sending real emails or API keys. (3) The included script prints any obtained API key to stderr ("✅ Free key: ..."), which can leak secrets into logs or agent traces — avoid using production credentials or set up an isolated/test account. (4) If you need this functionality, prefer providing a scoped API key (not your personal or high-privilege email/credentials) and consider contacting the vendor or examining network traffic to confirm no unexpected endpoints are used. If you want higher assurance, ask the publisher for provenance (homepage, source repo) or for the skill to declare required env vars in the manifest and to stop echoing secrets.

Type: OpenClaw Skill Name: supportforge Version: 1.0.0 The skill bundle is classified as suspicious due to a critical shell injection vulnerability in `scripts/forge-client.sh`. The script directly passes user-controlled input (`$1`) as the data payload to `curl -d "$1"` for the `create` and `search` actions. This allows an attacker to inject arbitrary shell commands or manipulate `curl` arguments by crafting malicious JSON input, potentially leading to remote code execution on the agent's host. The `API_BASE` URL is also configurable via `SUPPORTFORGE_API_URL`, which could be abused to redirect traffic to a malicious server if an attacker can control the environment.