PaperMC AI Operations

Manage PaperMC Minecraft servers through safe, controlled interfaces. Use for server lifecycle management, backups, plugin operations, and health monitoring...

Key things to consider before installing or running this skill: - Do not run the publish scripts (publish_skill.py or publish_to_clawhub.py) unless you explicitly want to upload the repository to ClawHub. They contain a hard-coded API token and will gather and POST many local text files — this could leak sensitive local content. Remove or rotate that token and review the scripts before any execution. - The SKILL.md safety policy forbids direct systemctl use, but manage_server.py calls systemctl (with sudo). Running that script will require sudo privileges and can perform system-level service restarts. If you allow the agent to run this skill, ensure the agent runs under a least-privilege account and review/modify the service_action implementation (avoid sudo or require manual confirmation). - plugin_manager.py and plugin_upgrade_framework.py will download jars from URLs and delete/replace plugin files. This is expected functionality but is powerful: verify URLs and run upgrades first in a test environment. Ensure backups work and point SERVER_DIR to a test server before executing. - The code contains developer-specific default paths (e.g., /home/yan/projects/..., SERVER_DIR = '/path/to/your/papermc-server') — update all path constants before use to avoid accidental operations on unintended directories. - There are undeclared dependencies used by scripts (requests, requests-toolbelt). Install and audit these packages from trusted package sources before running. - If you want to proceed: (1) audit and remove or sanitize publish_* scripts (or at minimum remove the embedded API token), (2) set SERVER_DIR and SERVICE_NAME to safe test targets, (3) run in a staging environment first, (4) avoid running scripts as root or with sudo unless necessary and reviewed, (5) consider restricting the agent's ability to autonomously invoke high-risk operations (require human confirmation for restart/update steps). Given the hard-coded token and the contradiction between declared safety rules and actual system commands, treat this skill as suspicious until you perform the code review and sanitization steps above.

Type: OpenClaw Skill Name: papermc-ai-ops Version: 2.0.1 The skill bundle is classified as suspicious primarily due to the inclusion of a hardcoded, sensitive API token for clawhub.ai across multiple files (simple_publish.sh, publish_skill.py, and publish_to_clawhub.py), which constitutes a significant credential leak. While the bundle's stated purpose is legitimate PaperMC Minecraft server management, it contains scripts with high-risk capabilities, including downloading and replacing executable JAR files from remote URLs (plugin_manager.py, update_paper.py, and plugin_upgrade_framework.py) and executing system-level commands via sudo systemctl (manage_server.py). Although these features are consistent with server administration, the exposure of credentials and the broad system access rights required make the bundle a security risk.