Quantinuumclaw

Enables building and deploying quantum computing applications with Quantinuum, Guppy, Selene, and Fly.io. Use for the OpenClaw Clinical Hackathon, clinical o...

This bundle appears to do what it says — scaffold a FastAPI backend (Selene), example Guppy circuits, a React frontend, and helpers to deploy to Fly.io. Before you use it: 1) Verify provenance — the README points to a GitHub repo (arunnadarasa/quantinuumclaw); check that upstream source and commits. 2) Inspect scripts that run automatic actions (scripts/flyio_deploy.py, scripts/create_quantum_app.py, scripts/setup_selene_service.py) for any network calls or shell execution you don’t expect. 3) Don’t put PHI in inputs; follow the SKILL.md admonition to use synthetic/de‑identified data. 4) Secrets: when targeting real hardware set QUANTUM_API_KEY via Fly.io secrets (do not commit keys or put them in frontend code). Also review the frontend proxy and CORS settings (templates allow_origins=["*"]) and restrict them for production. 5) When told to install tools (flyctl via curl|sh or pip/npm), prefer installing from trusted package sources or review the install script first. If you want higher assurance, run the templates locally in an isolated dev environment, review Dockerfile and deploy scripts, and scan the repository with your standard supply-chain/security tooling.

Type: OpenClaw Skill Name: quantinuumclaw Version: 0.1.0 The skill bundle is suspicious due to several vulnerabilities in the generated code and default configurations, rather than intentional malice. The `assets/selene-template/main.py` file defaults to a wide-open CORS policy (`allow_origins=["*"]`), which is a significant security flaw, despite a `TODO` comment. Additionally, the `scripts/lovable_integrate.py` script generates frontend files by directly embedding user-provided arguments (like `app-name`, `quantum-use-case`, `backend-url`) into HTML and JavaScript templates without sanitization, creating a reflected XSS vulnerability in the generated frontend if the AI agent is prompted with malicious input. The skill's documentation, however, provides good security advice, such as using Fly.io secrets for API keys and synthetic data for clinical demos.