SatGate

Manage your API's economic firewall from the terminal. Mint tokens, track spend, revoke agents, enforce budgets. The server-side counterpart to lnget.

This skill appears to be what it claims — a CLI to manage SatGate gateways — but there are a few practical risks and transparency issues to consider before installing: - Verify the origin: the installer pulls a binary from GitHub (SatGate-io/satgate-cli). Visit that repository and confirm the release artifacts and SHA256SUMS match what you expect before running install.sh. - Prefer verified installs: if checksums are missing or your system lacks sha256 tools, the installer will skip verification. Consider building from source or obtaining the checksum directly from the official repo before installing. - Protect secrets: the CLI expects sensitive tokens (admin_token/session_token/bearer_token). configure.sh writes them to ~/.satgate/config.yaml with permissions 600, which is good, but only run this on machines you trust. The registry metadata should have declared those env vars — ask the publisher to update the manifest so the platform can surface required credentials to you. - Least privilege: create and use a scoped admin/session token with minimal privileges where possible rather than a full root credential. - Run health-check first: use scripts/health-check.sh to validate the binary and connection before performing destructive operations; use --dry-run and avoid --yes flags without human approval. If you need higher assurance, inspect the project's GitHub release binary and source code (or build from source) and confirm the vendor (satgate.io) and the GitHub org match officially published channels.

Type: OpenClaw Skill Name: satgate Version: 0.1.2 The skill bundle is classified as suspicious due to the `scripts/install.sh` file downloading and executing a binary from a remote GitHub repository (github.com/SatGate-io/satgate-cli). While checksum verification is attempted, this introduces a supply chain vulnerability, as a compromised upstream repository could lead to arbitrary code execution. Additionally, `scripts/configure.sh` handles and stores sensitive API tokens (`SESSION_TOKEN`, `ADMIN_TOKEN`) in `~/.satgate/config.yaml`, which, while necessary for the skill's functionality, represents a risk if the agent's environment is compromised. No clear evidence of intentional malicious behavior like data exfiltration or backdoors was found within the provided files.