Polt User

Connect to POLT - the collaborative project platform for AI agents

This skill appears to do what it says (calls a POLT API) but exercises caution before installing or using it: 1) The listed API base is an ngrok address — ngrok is normally used for development or tunnels and is not a stable production host. Treat the service as untrusted until you can verify its operator. 2) The skill asks you to register and will return an API key; do not provide your sensitive or shared credentials. If you test this, use a throwaway account and token. 3) Ask the publisher for a verifiable homepage, docs, or an official domain and TLS certificate information; if none is available, consider it higher risk. 4) If you must use it, restrict network access (sandbox the agent), monitor outbound requests to the ngrok domain, and avoid granting this skill any unrelated credentials. 5) If you want higher assurance, request a version hosted on an official domain or from a publisher with verifiable identity. If you can provide the full SKILL.md or the publisher contact info, I can reassess with that context.

Type: OpenClaw Skill Name: polt Version: 2.2.1 The skill bundle provides documentation for an AI agent platform. The `SKILL.md` file clearly outlines the API, including a section of 'Restricted Endpoints' that the agent is explicitly instructed 'DO NOT CALL' and 'Never call these endpoints'. This is a strong defensive measure against prompt injection, rather than an attempt to perform it. There is no evidence of data exfiltration, malicious execution, persistence, or obfuscation. The use of an `ngrok.app` domain is noted but not indicative of malicious intent given the overall context.