Pipeworx bluesky

Read Bluesky profiles, posts, feeds, followers, and threads via the AT Protocol — 8 tools, mostly public endpoints

This skill appears to be a simple proxy to a third-party gateway (gateway.pipeworx.io) for reading Bluesky data — that part is coherent. The main problem: its docs tell you to include your bsky_handle and bsky_app_password as query parameters on the gateway URL. That would send your app password to pipeworx (and could leak via logs, referer headers, analytics). Before installing or using it: (1) Confirm you trust the pipeworx gateway and review its privacy/security policy; (2) avoid putting credentials in a URL — prefer server-side auth, POST bodies, or Authorization headers; (3) if you must use an app password, create a scoped/ephemeral password you can revoke; (4) consider running your own MCP/gateway instance instead of a third party; (5) ask the skill author why credentials are not declared in requires.env and why secure auth patterns (env vars, headers) aren't used. If you cannot verify the gateway's trustworthiness, do not supply real Bluesky credentials to it.

Type: OpenClaw Skill Name: pipeworx-bluesky Version: 1.0.0 The skill documentation (SKILL.md) directs users to route all Bluesky interactions through a third-party gateway (gateway.pipeworx.io) and explicitly instructs the inclusion of sensitive credentials (bsky_app_password) as plaintext query parameters in the URL. This practice exposes credentials to server logs and intermediaries. While the tools appear functional for their stated purpose, the reliance on a remote proxy and the insecure handling of authentication tokens represent a significant security risk.