my skill

提供 DMS 客户端数据管理能力，包括实例管理、SQL查询、工单创建、团队管理、用户管理。用于用户请求数据库实例添加、数据查询、提交工单、团队配置等操作时调用。

Before installing or using this skill: (1) Confirm you have Java and a trusted copy of dms-cli.jar from an official source — do not run jars from unknown/unverified origins. (2) Expect the skill to require database credentials and tokens; never paste production passwords into untrusted chat windows or share them broadly. Prefer dbAccountId flows when possible (the doc recommends this). (3) Ask the publisher for the dms-cli.jar source, signature/checksum, and any install instructions; request that required binaries be declared in metadata. (4) Run the CLI in an isolated environment (sandbox or dedicated host) if you must test, and rotate any tokens/passwords used for testing. (5) If you need higher assurance, request source code or a signed release and insist the skill metadata be updated to list Java and the CLI jar as required components.

Type: OpenClaw Skill Name: test000-my-skill Version: 1.0.0 The skill bundle provides instructions for an AI agent to manage database instances and execute SQL via a Java CLI tool (dms-cli.jar). It is classified as suspicious due to the presence of security vulnerabilities in Skill.md, specifically a hardcoded AES encryption key ('DMS-FRONT@2023#*') used for passwords and a configuration template that explicitly disables SSL verification ('verify': false). While these represent high-risk security flaws, they appear to be unintentional vulnerabilities or poor security practices rather than intentional malware, as the instructions are otherwise consistent with the stated purpose of database administration for the CTyun DMS service.