Securely fetch credentials from LastPass vault via lpass CLI.

This skill will run your local lpass CLI to print vault fields to stdout. Before installing: (1) Confirm you trust the skill source and inspect the small script (it simply runs 'lpass show'). (2) Ensure the agent environment actually has the 'lpass' binary and a valid LastPass session — the skill metadata should be updated to declare 'lpass' as a required binary. (3) Be aware that any secret returned is printed to stdout and could be logged or exfiltrated by the agent; only allow use in trusted, minimal-privilege contexts and prefer user-invocation. (4) Ask the maintainer to add explicit required-binaries metadata, guidance in SKILL.md about safe secret handling (avoid logs, prefer ephemeral usage), and input validation (sanitize entry names) before deploying widely.

Type: OpenClaw Skill Name: lastpass-cli Version: 0.1.0 The skill is classified as suspicious due to its inherent high-risk capability: accessing sensitive LastPass credentials via the `lpass` CLI, as implemented in `tools/lastpass.sh`. While this behavior is explicitly aligned with the stated purpose in `SKILL.md` and there is no evidence of additional malicious intent (such as data exfiltration, persistence, or prompt injection against the agent), the direct access to a local secrets vault constitutes a significant 'risky capability' as defined by the provided threshold.