Openclaw Cat

Cat Life Status Query Skill. Triggers when you send /cat command or ask about your cat. The skill calls the underlying LLM model to interact with you as a sa...

What to check before installing / running this skill: - Verify missing files: SKILL.md and README reference config.json and config.json.example, but the bundle manifest does not include those files. Before running, ensure a legitimately-supplied config.json.example exists or create config.json yourself. Do not run it blindly. - Secret handling: The skill expects you to put your model API key into config.json (plaintext). Prefer using a platform-managed secret or an environment variable and avoid committing the config file to source control. If you must use config.json, store it somewhere private and exclude it from VCS. - base_url caution: The skill lets you set base_url. Only use official provider endpoints. Do not set base_url to unknown servers — an attacker-controlled base_url could capture your API key and prompts. - Review and run in a sandbox: The code issues network calls (requests.post) to LLM provider endpoints. If you have concerns, review the full cat_handler.py file locally and run it in an isolated environment before giving the skill to an agent with network access. - Metadata mismatch: The registry metadata did not declare the config path or any required files; ask the publisher to correct the manifest (declare required config path and include config.json.example) before trusting the package. If you want to proceed: create a config.json locally with only the minimal api_key and cat_name fields, verify default base_url values in the code are the official provider URLs, run locally to confirm behavior, and avoid enabling any autonomous/internet-facing execution for untrusted agents until you're satisfied.

Type: OpenClaw Skill Name: openclaw-cat Version: 0.1.1 The OpenClaw AgentSkills bundle 'openclaw-cat' is benign. The `cat_handler.py` script correctly implements the described functionality of querying an LLM to generate cat status responses. It uses `requests` to communicate with configured LLM APIs (e.g., OpenAI, GLM) and handles API keys as expected for authentication. File operations are limited to its own `config.json`, `cat_prompt.md`, and `.cat_cache.json` for persistent cat attributes. There is no evidence of data exfiltration, unauthorized command execution, or prompt injection attempts against the OpenClaw agent within `SKILL.md` or `cat_prompt.md` that would lead to malicious actions.