Platform API Connector

Connect to social media and content platform APIs by navigating developer portals, creating apps, obtaining OAuth tokens, and storing credentials. Covers Fac...

This skill appears to be an instruction guide for obtaining OAuth tokens and storing them — that behavior by itself is consistent with the description. Before installing or using it, verify these points: (1) Where will you store credentials? Provide a secure, access-controlled/ encrypted secrets store (not plaintext JSONB unless you add envelope encryption). (2) The SKILL.md mentions storing secrets in Supabase but declares no DB connection or credentials — ensure you never supply DB credentials or tokens to untrusted code and consider least-privilege DB roles. (3) Validate claims about token lifetimes (e.g., 'never expire' statements) against current platform docs and plan token rotation. (4) If you implement the provided snippets, run them locally and inspect any helper functions (get_connection/update_connection) to make sure they do not exfiltrate tokens. (5) If you intend the agent to store or retrieve credentials automatically, require explicit, audited connector configuration (connection URL, API key) and consider requiring user confirmation before any persistent writes. If you want me to, I can point out exact places in the SKILL.md to modify so it enforces encryption, least privilege, and explicit DB connection configuration.

Type: OpenClaw Skill Name: platform-api-connector Version: 1.0.0 The skill is classified as suspicious due to its core functionality involving the acquisition and storage of highly sensitive API credentials (client secrets, access tokens, refresh tokens, API keys) for various social media platforms. The `SKILL.md` explicitly instructs the AI agent to store these critical credentials in a database, even providing a `CREATE TABLE` SQL schema for this purpose. While the stated intent is to manage API connections, the instruction to store such sensitive data without explicit mention of robust security measures (e.g., encryption at rest, secure key management) represents a significant security vulnerability. A compromise of the database or the agent could lead to a major data breach. Additionally, `references/oauth-flows.md` details running a local HTTP server for OAuth callbacks, further highlighting network activity and sensitive data handling.