A mindset skill that interrupts hype-driven decisions and gives a calmer, more deliberate next step. Use when the user feels pressure to act on a crypto inve...

This skill's content (a 'cooldown' prompt) is benign, but the included handler.py contains a hard-coded absolute path to /Users/jianghaidong/.openclaw/skills/... which is inconsistent with a distributed skill and unnecessary for its stated purpose. Risks and actions to consider: - Risk: If executed as-is, the handler may attempt to read SKILL.md from that specific local path. On your system this will likely fail, but if that path exists it could read local files unexpectedly. This is probably a packaging bug or leftover developer debug code rather than clear malicious behavior, but it is inappropriate for a prompt-only skill. - Do not install or allow autonomous execution until the author fixes the code. Ask the publisher to: 1) Remove the hard-coded user path and use a relative or packaged path for SKILL.md, or avoid local file reads entirely (the skill is prompt-only). 2) Explain why file I/O is needed and provide a cross-platform safe implementation. - If you still want to try it locally, run it in a locked-down sandbox environment and inspect files before granting it access. Prefer to install only after the maintainer provides a corrected handler that does not reference user-specific absolute paths. If the owner cannot explain or fix the hard-coded path, treat this package as untrustworthy.

Type: OpenClaw Skill Name: crypto-fomo-cooldown Version: 1.0.0 The handler.py file contains a path traversal vulnerability in the _load_skill_meta function, which constructs a file path using an unsanitized user-provided skill_name. Furthermore, the code uses a hardcoded absolute path referencing a specific local user directory (/Users/jianghaidong/), which is a significant security flaw and highly irregular for a portable skill. While these issues represent critical vulnerabilities, they appear to be unintentional bugs or poor development practices rather than active malware, as no exfiltration logic is present.