Misskey

Misskey API integration for posting notes and uploading media to Misskey/Fediverse instances. Use when users want to post to Misskey, upload images, or inter...

This skill implements exactly what it says (posting, uploading, deleting, whoami) but the package metadata omitted required environment variables and expected binaries. Before installing: 1) be prepared to set MISSKEY_HOST and MISSKEY_TOKEN (the scripts default to https://maid.lat if you forget); 2) ensure curl and python3 are available; 3) inspect or replace upload.sh's use of eval (it can be exploited if used with untrusted input) — a safer direct curl invocation is preferable; 4) don't expose a high-privilege token: create a token with minimal permissions and never commit it to version control; and 5) if you require stronger assurance, ask the publisher to update the registry metadata to declare MISSKEY_HOST/MISSKEY_TOKEN and required binaries, and to remove eval usage.

Type: OpenClaw Skill Name: misskey Version: 1.0.2 The skill provides functional Misskey API integration but contains a shell injection vulnerability in scripts/upload.sh, where the script uses eval to execute a command string containing potentially unvalidated environment variables and file paths. While the logic aligns with the stated purpose of posting to the Fediverse, the use of eval on constructed strings is a high-risk coding practice that could be exploited if inputs are manipulated. No evidence of intentional malice or data exfiltration was found.