W-Spaces Deploy

Deploy static websites to W-Spaces. Use when deploying HTML/CSS/JS sites, landing pages, or single-page apps to wspaces.app. Supports project creation, code...

Before installing or running this skill: 1) Inspect the included scripts (wspaces_*.sh) yourself — they are small and readable; confirm curl/jq/python3 usage. 2) Know that the scripts require and will send WSPACES_API_KEY to the API_BASE (default https://api.wspaces.app); do not set WSPACES_API_URL to an untrusted host because the scripts will send your key there. 3) The registry metadata incorrectly lists no required env vars/binaries — treat that as a quality/attention-to-detail issue and verify requirements manually. 4) Prefer creating a limited-scoped API key for CI or short-lived use and avoid putting long-lived secrets directly into persistent dotfiles unless you understand the exposure. 5) Because the package source/homepage is unknown, only proceed if you trust the publisher or after running the scripts in an isolated environment; if you need higher assurance, ask the publisher for a canonical homepage/repository and a signed release.

Type: OpenClaw Skill Name: wspaces-deploy Version: 1.0.0 The skill provides a set of tools for deploying static websites to wspaces.app, but it contains several security vulnerabilities. Specifically, `wspaces_auth.sh` and `wspaces_project.sh` manually construct JSON payloads using unescaped shell variables, which is a classic JSON injection vulnerability. Furthermore, `wspaces_auth.sh` encourages passing sensitive passwords as command-line arguments, which can expose them in system process lists. While the core logic appears to serve its stated purpose and `wspaces_push.sh` correctly uses Python for JSON escaping, the lack of consistent input sanitization across the bundle poses a risk in an AI agent environment.