Today Task For Xiaoyi Claw

小艺claw专用任务结果推送器，当任务完成后将结果推送到负一屏。使用统一的标准数据格式，支持各种类型的任务结果推送。

This skill appears to implement its stated function (format task results and POST them to a Huawei endpoint), but there are important red flags you should consider before installing: - Metadata mismatch: The registry metadata claims no credentials or config paths are required, but the code requires a local credential file (~/.openclaw/.xiaoyienv) containing PERSONAL-API-KEY and PERSONAL-UID. Expect to create that file if you run it. - Hard-coded external endpoint: All data are sent to a fixed Huawei URL in the code. You cannot change the destination via metadata; if you need a different endpoint or want to keep data local, you'll have to modify the code. - Secret leakage: The code prints the credential values to the console (it prints the parsed keys). In shared environments or CI this will expose sensitive tokens. Consider editing the code to remove those prints before use (or run in an isolated environment). - Local file access: The skill reads a global user path outside its own directory. If you share the machine or use global credentials for other services, this increases risk. - Logs and records: By default it writes logs and push_records locally; inspect these directories and consider disabling save_records if you don't want local copies. Recommendations: 1. Treat this as suspicious rather than outright malicious; it likely is functional but sloppy. Only install if you trust the author/source. 2. Before running, review and/or modify hiboards_client.read_xiaoyienv and push() to remove any prints of secret values and to allow a configurable credential path or to avoid using global credentials. 3. If you don't trust the default endpoint, modify the code to accept a configurable endpoint (and avoid hard-coded URLs). 4. Run in an isolated environment or container, and avoid supplying production credentials until you've audited the code and removed the secret-printing behavior. 5. If you need the functionality but want lower risk, ask the maintainer to update the skill metadata to declare the required config path and to stop printing secrets, or fork and harden the code yourself.

Type: OpenClaw Skill Name: today-task-for-xiaoyi-claw Version: 1.0.26 The skill reads sensitive credentials (PERSONAL-API-KEY and PERSONAL-UID) from a hardcoded path outside its own directory (/home/sandbox/.openclaw/.xiaoyienv) and transmits them to a hardcoded external Huawei Cloud endpoint (dbankcloud.cn). While the SECURITY.md and SKILL.md files transparently document this behavior as necessary for the 'Xiaoyi Claw' integration, the direct access to files in the sandbox home directory and the hardcoding of API endpoints represent significant security risks. It is classified as suspicious rather than malicious because the behavior is documented and the data is sent to a legitimate service provider (Huawei) as part of the stated functionality.