Oauth Helper

Automate OAuth login flows with user confirmation via Telegram. Supports 7 providers: Google, Apple, Microsoft, GitHub, Discord, WeChat, QQ. Features: - Auto-detect available OAuth options on login pages - Ask user to choose via Telegram when multiple options exist - Confirm before authorizing - Handle account selection and consent pages automatically

Key things to verify before installing/using this skill: - Ask the publisher for source code or a homepage; this skill currently has 'unknown' source and no homepage. - Confirm exactly how Telegram integration works: which env vars or tokens are required (TELEGRAM_BOT_TOKEN, CHAT_ID, etc.), and ensure tokens are provided only via secure platform secrets (not pasted into chat). - Verify how the agent will access the 'clawd' browser profile (what path or credential) and whether that profile contains logged-in accounts you trust being used for OAuth. - Understand what the skill will send to Telegram: screenshots of QR codes and login pages may contain sensitive info. Insist on limiting or redacting data where possible. - Test with throwaway/dummy accounts first (not your primary Google/Microsoft/GitHub accounts) to confirm behavior and that no unwanted scopes/authorizations occur. - Prefer skills that explicitly declare required env vars, permissions, and a verifiable source; if the publisher cannot provide those, do not grant access to real accounts. If you are not comfortable providing access to a logged-in browser/profile or to a Telegram channel bot, do not enable this skill.

Type: OpenClaw Skill Name: oauth-helper Version: 1.1.0 The OpenClaw AgentSkills skill bundle is classified as benign. The `SKILL.md` content clearly outlines a workflow for automating OAuth login flows, which involves browser interaction (navigation, clicking elements) and user confirmation via Telegram. All described actions are directly aligned with the stated purpose and do not contain instructions for data exfiltration, malicious execution, persistence, or prompt injection designed to make the agent act maliciously. The 'One-Time Setup' section provides example `browser` commands for a human to configure the environment, not for the agent to execute as part of the skill's runtime.