RPA Caller

通过 HTTP 请求调用 RPA 自动化功能，让机器人完成指定任务。 当用户提到「RPA」「自动化」「机器人执行」「让机器人帮我」「自动填表」「自动点击」 「批量处理」「自动化流程」「运行任务」「触发流程」等词时，必须使用此 skill。 适用场景：触发 RPA 任务、查询任务状态、停止任务、传参数给 RPA 流程。

This skill is plausible for calling an RPA service, but review these points before enabling it: (1) The skill asks you to provide BASE_URL and an API_KEY — prefer a least-privilege/scoped token and never paste high-privilege secrets into long-lived public chat logs. (2) The agent will construct and send HTTP requests to whatever BASE_URL you give it; do not point it at sensitive internal services unless you trust the agent and network isolation (this can be used to access internal endpoints). (3) The SKILL.md mentions an Excel file (rpa-api-map.xlsx) but the package contains a JSON map — verify the API map is correct and that endpoints are what you expect. (4) If you worry about automated calls, restrict the agent's ability to act autonomously (require explicit user confirmation for each run) and prefer manual paste of short-lived tokens. (5) Audit the RPA endpoints and logs on the server side, and consider network-level controls (firewall, allowlist) to limit where the agent can connect.

Type: OpenClaw Skill Name: rpa-caller Version: 1.0.0 The rpa-caller skill enables an AI agent to perform arbitrary HTTP requests to a user-defined BASE_URL for tasks such as file downloading, form filling, and screen capturing. While the instructions in SKILL.md include safety measures like user confirmation and warnings against plaintext credential storage, the skill's core functionality involves high-risk capabilities (network access and file manipulation) that could be leveraged for SSRF or data exfiltration if the agent is misdirected. No evidence of intentional malice or hardcoded malicious endpoints was found in SKILL.md or references/rpa-api-map.json.