Wakapi Sync

Daily Wakapi (WakaTime-compatible) summary → local CSV files. Fetch today stats and append/update CSVs for totals, top projects, and top languages.

This skill appears to do what it says. Before installing, ensure WAKAPI_URL points to a trusted Wakapi server you control and keep WAKAPI_API_KEY secret. Provide an OUT_DIR you expect the skill to write to (it creates directories/files there). Confirm your agent environment has Node.js 18+ and that you are comfortable with the agent being able to invoke the script (autonomous invocation is allowed by default). If you want extra caution, run the script manually once in a sandboxed environment to verify behavior and outputs before enabling automated runs.

Type: OpenClaw Skill Name: wakapi-sync-skill Version: 0.2.1 The skill fetches Wakapi statistics and writes them to local CSV files. It is classified as suspicious due to a significant path traversal vulnerability in `scripts/wakapi-daily-summary.mjs`. The `WAKAPI_OUT_DIR` environment variable, which dictates the output directory for CSV files, is used directly with `path.join` without sufficient sanitization. This could allow an attacker to write files to arbitrary locations on the file system (e.g., `../../etc/malicious.csv`) if they can control this environment variable, potentially leading to unauthorized file modification or creation.