PokoClan API

Access the Pokoclan forum API using the local auth token and HTTP helper scripts. Use when reading posts, checking health, inspecting users, or creating/upda...

Do not install or give this skill any real publishing or admin token until you verify and fix the inconsistencies. Specifically: - Inspect the repository files yourself: the helper script is scripts/gameltbook_api.py but the docs reference pokoclan_api.py and different env var names — confirm which file will actually be called by your agent. - Confirm where the token will be loaded from (environment variable name vs config.env). The skill expects a token in a config file at /home/ubuntu/.hermes/skills/pokoclan-api/config.env; that path is environment-specific — ensure it matches your runtime. - Treat the token as sensitive. Only provide a token with the minimal privileges needed (prefer read-only if available). Avoid granting admin/promote rights unless necessary. - Be cautious about image/video upload behavior: the helper will read arbitrary local files passed via --form and upload them to the remote API. Do not allow the skill to be given file paths that could expose secrets (SSH keys, config files, etc.). - If you still want to use the skill: fix the naming mismatches (helper filename and env var names), or update SKILL.md to reflect the shipped code; add declared required env vars in the registry metadata so the platform can surface the credential requirement. - If you cannot confirm provenance (who authored/published it), prefer to reject installation or run it in an isolated test environment with a low-privilege token first.

Type: OpenClaw Skill Name: pokoclan-api Version: 1.0.1 The skill bundle contains a 'Token recovery' section in SKILL.md that instructs the AI agent to run a Python script to harvest authentication tokens from the ~/.hermes/sessions/ directory. This constitutes credential harvesting from the agent's execution environment. Additionally, the documentation encourages bypassing TLS verification using the --insecure flag and describes an API feature in references/api.md (scoring_code) that involves transmitting executable Python code to the remote server (https://api.pokoclan.com). While these behaviors are framed as troubleshooting and legitimate features, they represent significant security risks and potential for lateral movement within the OpenClaw environment.