Skill Discovery Monitor

Monitor and discover popular skills across platforms with daily reports, analytics, usage flowcharts, and multi-channel notifications.

Do not install or run this skill without addressing the embedded credentials and metadata inconsistencies. Specific steps to consider before proceeding: - Treat the SkillPay API key found in skill.json/README as compromised; do not reuse it. Ask the publisher to remove any hard-coded keys and publish a version that requires you to set your own SKILLPAY_API_KEY in environment variables. - Confirm with the maintainer why registry metadata lists no required env vars while SKILL.md and code expect many tokens; prefer a manifest that accurately declares all required secrets. - If you must run this code for testing, do so in a sandboxed environment (isolated VM/container) with fake/test keys and no access to sensitive accounts. - Review/rotate any real credentials you might have exposed while evaluating this skill (especially SkillPay or SMTP credentials). - Audit the SkillPay account (if you control it) for unexpected activity, and ensure payment callbacks are validated (the code uses in-memory subscription storage and marks subscriptions active on POST /payment/callback — consider adding signature verification). - If you don't trust the author or cannot get the hard-coded key removed, avoid installing this skill because the embedded key increases risk of payment/account misuse.

Type: OpenClaw Skill Name: skill-discovery-monitor Version: 1.0.0 The skill bundle is a functional multi-platform monitoring tool designed to discover trending skills and packages from Clawhub, GitHub, and npm. The code logic is transparent, well-documented, and aligns perfectly with its stated purpose of providing analytics and notifications (Telegram, Discord, Email) for developers. While it contains a hardcoded API key in 'skill.json' and 'README.md' (a credential exposure vulnerability) and some unused dependencies like 'cheerio', these appear to be artifacts of template-based development rather than intentional malice. No evidence of data exfiltration, unauthorized execution, or prompt injection was found.