Samvida

Generate an agentic contract (llms.txt) for any business website. Crawls the site, fills gaps conversationally, and produces a structured agent-optimized llm...

Samvida appears to do what it says, but keep these practical cautions in mind before installing or running it: - Data exposure: the crawler extracts raw page text, emails, and other contact details and sends that content to your configured OpenClaw LLM for generation. Do not use it on sites containing sensitive or private information unless you accept that those page contents will be processed by your LLM provider. - Internal/host-reachability risk: the crawler will fetch any URL you (or the agent) provide. If the agent runs in an environment that can reach internal/private hosts, you could accidentally cause the skill to crawl internal services. Only provide URLs you intend to be crawled. - Deploy credentials: Cloudflare/Webflow tokens are requested only at deploy time and appear to be used directly to call provider APIs. Before giving a token, verify its scope and only grant the minimum necessary permissions (e.g., Workers Scripts: Edit for Cloudflare). Double-check the worker JS payload that will be uploaded if you choose to deploy. - Environment assumptions: the skill assumes a Python virtualenv at ~/.virtualenvs/samvida and an OpenClaw workspace path (~/.openclaw/workspace/samvida). If your environment differs, the provided CLI examples will fail; create the venv or adjust paths as needed. - Review outputs before publishing: the generated llms.txt may include extracted personal emails/names and any user-provided conversational answers. Inspect the draft and the final file before deploying it to a public domain. If you want tighter safety: test the skill on a non-sensitive public site first, confirm the /tmp files and worker script contents locally, and restrict deploy tokens to minimal scopes or use temporary sandbox accounts for initial runs.

Type: OpenClaw Skill Name: samvida Version: 0.3.3 The skill's core functionality (crawling, generating, and deploying llms.txt) appears legitimate. However, the SKILL.md instructions repeatedly direct the OpenClaw agent to execute shell commands with user-provided inputs (e.g., `{url}`, `{token}`, `{domain}`) without explicit sanitization. This introduces a significant shell injection vulnerability (Remote Code Execution risk) in SKILL.md during both the crawl and deploy phases, as a malicious user could potentially inject arbitrary commands into the shell execution.