Preflight Check

Pre-flight environment validator — checks that all required binaries, environment variables, and services are available before running other skills

This skill appears to do what it says (preflight checks) but there are important mismatches and privacy risks you should consider before installing or running it: - Metadata mismatch: The skill's metadata declares no required env vars, yet the instructions read many sensitive variables (service tokens, private keys, GOOGLE_APPLICATION_CREDENTIALS). Ask the author to declare all env vars and explain why each is needed. - Secret handling: The SKILL.md prints fragments of sensitive values and writes a JSON report to disk. Ensure reports never include full secrets, are stored in a secure location, and are not sent to external endpoints. Prefer presence checks (test -n, test -f) instead of echoing secret contents. - Permissions: claw.json requests filesystem and network access. If you allow this skill, restrict it to user-invoked runs (disable autonomous invocation) or run it in an isolated/local environment to avoid accidental exfiltration. - Operational controls: If you still want to use it, require the author to: 1) Update metadata to list the env vars/binaries it will access. 2) Remove or redact any printing of secret values (do not include private key fragments in reports). 3) Make network checks explicit and optional, and document any external endpoints contacted. 4) Provide a signed/known source or package release (currently source/homepage are unclear). If you cannot get those assurances, run this skill only in a controlled environment (throwaway project or ephemeral container) and inspect the generated report before sharing it.

Type: OpenClaw Skill Name: preflight-check Version: 0.1.0 The skill is designed for environment validation but contains instructions in SKILL.md that risk exposing highly sensitive credentials. It directs the agent to read and output environment variables such as SUPABASE_SERVICE_ROLE_KEY and FIREBASE_PRIVATE_KEY into a diagnostic report. While some tokens are partially masked using 'head', others are echoed in full, which could lead to accidental credential leakage in logs or the generated 'preflight-report.json' file.