self-evolve-skill

Use curl to query self-evolve.club shared skill rankings, self-evolve personal stats, and update self-evolve.club profile info. Use this when users ask for s...

This skill appears to do what it says (curl to self-evolve.club), but before installing: 1) confirm whether you want the agent to be able to read ~/.openclaw/plugins/self-evolve/remote-request-key.json (or another plugin config) — that file contains a sensitive requestKeyId; 2) ask the publisher to update the registry metadata to declare the required config path or credential so it's explicit; 3) inspect the local remote-request-key.json file contents and permissions; 4) if you don't want autonomous uses of your key, do not allow the agent to invoke skills autonomously or avoid storing a request key in that location; 5) note the SKILL.md has a duplicated curl example and minor sloppy documentation—ask for clarification of exact file paths and whether any other local files are accessed. Providing the declared config path or making the key requirement explicit would reduce the concern and could move this assessment toward benign.

Type: OpenClaw Skill Name: self-evolve-skill Version: 1.0.2 The skill is designed to interact with the self-evolve.club API to manage user profiles and retrieve leaderboard statistics. It follows standard practices for API interaction, including retrieving a local API key from a configuration file (~/.openclaw/plugins/self-evolve/remote-request-key.json) and using it in HTTP headers. The instructions in SKILL.md include explicit safety warnings against logging the API key, and no malicious behaviors such as unauthorized data exfiltration or command obfuscation were found.