OpenAI Agent SDK

Build multi-agent AI systems with OpenAI Agents SDK. Create, orchestrate, and manage AI agents with tools, handoffs, guardrails, and tracing. Supports 100+ L...

This package appears to implement what it claims (an agents SDK) but exercise caution before installing or running it: - The SKILL.md tells you to set OPENAI_API_KEY (and shows other provider keys) but the skill metadata does not declare required credentials. Treat that as a red flag: only provide minimal, scoped API keys and avoid using primary/production keys for testing. - Example code contains eval() inside a tool (calculate). Do not run that example or reuse that tool with untrusted inputs—eval can execute arbitrary code. - There is no homepage or known source listed. Verify the package provenance (look up 'openai-agents' on PyPI/GitHub and confirm the maintainer) before pip installing. Prefer installing in an isolated environment (virtualenv/container) and inspect the installed package files. - If you must use this skill: (1) use least-privilege API keys, (2) review example and template code for unsafe constructs (eval, unsanitized function inputs), and (3) run in a sandbox until you confirm the package matches official sources.

Type: OpenClaw Skill Name: openai-agent-sdk Version: 1.0.0 The skill bundle contains a critical Remote Code Execution (RCE) vulnerability in 'examples/tools_example.py' and 'SKILL.md'. The 'calculate' tool uses the Python 'eval()' function to process user-provided strings without any sanitization, which allows for arbitrary code execution. While this appears to be a poorly implemented example rather than intentional malware, the inclusion of such a dangerous pattern in a 'Best Practices' section is highly risky.