← Back to Skills Marketplace
pandora
by
kleberbaum
· GitHub ↗
· v0.1.0
687
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install pandora
Description
Pandora namespace for Netsnek e.U. secrets and configuration management vault. Securely stores API keys, database credentials, and environment configs with v...
Usage Guidance
Do not use this skill to store real secrets. The documentation describes vault behavior (encryption, rotation, KMS, returning secret values) but the included script only prints which mode was requested and does not implement storage, encryption, or network/back-end integration. Before installing or using: (1) ask the author for the full implementation and provenance (homepage, repo); (2) review and validate the actual code that will read/write secrets and any network calls; (3) require explicit documentation of encryption algorithms, key management, and required credentials; (4) if you must test, do so in an isolated environment with dummy secrets only; (5) prefer well-known, audited vault solutions for production secrets. If the author provides a real implementation, re-evaluate to ensure required env vars and backend access are appropriate and proportional.
Capability Analysis
Type: OpenClaw Skill
Name: pandora
Version: 0.1.0
The skill is suspicious due to a significant potential shell injection vulnerability. The `SKILL.md` instructs the AI agent to execute `scripts/vault-ops.sh` with user-controlled `--key` and `--value` arguments, and the skill explicitly requests `exec` permissions. While the `scripts/vault-ops.sh` file is currently an incomplete stub that does not process these arguments, the intended design of passing unsanitized user input directly to a shell script with execution privileges creates a high-risk pattern for shell injection if the script were fully implemented.
Capability Assessment
Purpose & Capability
The name/description advertise a full-featured secrets vault (encryption at rest/in transit, backends such as KMS or remote vault, rotation, access control). The package contains only an instruction file and a tiny script that only echoes which mode was requested; there is no code to encrypt, persist, rotate, list keys, integrate with KMS, or enforce access control. The claimed capabilities would legitimately require additional code, credentials, or config that are not present.
Instruction Scope
SKILL.md tells users to run scripts/vault-ops.sh to store/rotate/list secrets and describes behavior such as prompting for secret values, reading stdin, and returning rotated values. The shipped script does not implement these behaviors — it only parses flags and prints mode messages. The instructions therefore promise actions that the runtime does not perform, which is misleading and could lead users to believe secrets are being managed when they are not.
Install Mechanism
There is no install spec and this is instruction-only with a small script file. That is low-risk from an installation perspective — nothing is downloaded or extracted from external URLs.
Credentials
The skill requests no environment variables, credentials, or config paths. That is proportionate to what is actually shipped (a no-op script). However, given the declared purpose (KMS/backends, production vault), one would normally expect credentials or configuration requirements; the absence is another sign of incompleteness or misrepresentation.
Persistence & Privilege
The skill is not always-enabled and is user-invocable. It requests exec permission in metadata so it can run the provided script; this is reasonable for a script-driven skill. There is no evidence it persists credentials, modifies other skills, or requests system-wide privileges.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install pandora - After installation, invoke the skill by name or use
/pandora - Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.1.0
Initial release: reserved pandora namespace for Netsnek e.U.
Metadata
Frequently Asked Questions
What is pandora?
Pandora namespace for Netsnek e.U. secrets and configuration management vault. Securely stores API keys, database credentials, and environment configs with v... It is an AI Agent Skill for Claude Code / OpenClaw, with 687 downloads so far.
How do I install pandora?
Run "/install pandora" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is pandora free?
Yes, pandora is completely free (open-source). You can download, install and use it at no cost.
Which platforms does pandora support?
pandora is cross-platform and runs anywhere OpenClaw / Claude Code is available (linux).
Who created pandora?
It is built and maintained by kleberbaum (@kleberbaum); the current version is v0.1.0.
More Skills