Zulip

Interact with Zulip chat platform via REST API and Python client. Use when you need to read messages from streams/topics, send messages to channels or users,...

This skill appears to do what it claims: it wraps the official Zulip Python client. Before installing or running: 1) confirm you obtained the 'zulip' PyPI package from the official source and verify its integrity; 2) inspect the included scripts (scripts/zulip_client.py) yourself — it is small and readable; 3) create the ~/.config/zulip/zuliprc file securely and limit its file permissions (it contains an API key); 4) only supply a bot account/API key with the minimal permissions needed; and 5) if you do not trust the skill publisher (no homepage/source listed), consider running it in a restricted environment or container and revoke the API key if you detect unexpected behavior.

Type: OpenClaw Skill Name: zulip Version: 1.0.2 The skill bundle is primarily benign, providing legitimate interaction with the Zulip API. However, it is classified as suspicious due to the inclusion of `curl` examples in `SKILL.md` and `references/api-quick-reference.md` that directly embed API keys in the command line (`-u "[email protected]:KEY"`). While common in API documentation, this practice poses a vulnerability risk as API keys could be exposed in process lists or shell history if an agent were to execute these commands directly without proper sanitization or secure credential handling, potentially leading to information leakage. There is no evidence of intentional malicious behavior or prompt injection attempts against the agent.