NetPad - Build forms, workflows and manage MongoDB data

Manage NetPad forms, submissions, users, and RBAC. Use when: (1) Creating forms with custom fields, (2) Submitting data to forms, (3) Querying form submissions, (4) Managing users/groups/roles (RBAC), (5) Installing NetPad apps from marketplace. Requires NETPAD_API_KEY for API, or `netpad login` for CLI.

Key things to consider before installing: (1) The skill requires an API key (NETPAD_API_KEY) even though the manifest omitted it — do not provide production credentials until you confirm trust. Use a test key if available. (2) Inspect the npm package @netpad/cli source (or its npm page and publisher) to ensure it’s legitimate and hasn’t been tampered with. (3) The included shell wrapper has coding bugs (e.g., add-field uses undefined variable names) — this suggests limited maintenance; test functionality in an isolated environment first. (4) Check where the netpad CLI stores credentials (local files, OS keychain) and whether it persists tokens; avoid giving long-lived production credentials until you’re comfortable. (5) If you need higher confidence, ask the publisher for source repo/homepage or a checksum for the npm package; presence of a well-known org website or GitHub repo would raise confidence.

Type: OpenClaw Skill Name: netpad Version: 1.0.0 The skill bundle is designed to manage NetPad forms, submissions, users, and RBAC via its API and CLI. The `SKILL.md` provides clear instructions and examples for interacting with the `netpad.io` service. The `scripts/netpad.sh` is a shell wrapper that uses `curl` and `jq` to perform API operations, correctly utilizing the `NETPAD_API_KEY` for authentication to the specified `netpad.io` domain. There is no evidence of data exfiltration, malicious execution (e.g., `curl|bash` from untrusted sources), persistence mechanisms, obfuscation, or prompt injection attempts against the agent to subvert its intended purpose. All actions are aligned with the stated goal of managing the NetPad service.