Nvidia Model Config

Add the NVIDIA provider to OpenClaw with SecretRef apiKey (no plaintext in openclaw.json). Documents shell vs systemd gateway env so the key actually resolve...

This skill appears coherent and implements exactly what it claims, but review and follow these safety steps before use: - Prefer the secure default (SecretRef) over --inline-key. Only use --inline-key for short-lived local tests and never commit configs with inline keys. - Beware: running --dry-run while using --inline-key will print the config (and the inline key) to stdout. Avoid dry-run when testing inline keys or ensure your terminal/stdout is not being captured. - If you use --setup-env the script will write an env file (mode 600) to the path you supply; confirm the path and permissions. The script sets 0600 which is good practice. - The script will create a user systemd override in ~/.config/systemd/user/... for the openclaw-gateway service. Verify the correct service name and that you want to reload/restart that user service. - Back up your openclaw.json (use --backup or manual copy) before running in non-dry-run mode. - Inspect the script yourself (it is included) and run it locally — it performs only local file edits and writes; it contains no network-exfiltration code. If you run it on a machine with remote logging/monitoring, be mindful of where stdout/stderr may be captured. If you want additional assurance, request a short code review of scripts/merge_nvidia_config.py for your environment or run it in a sandboxed/test workspace first.

Type: OpenClaw Skill Name: nvidia-model-config Version: 1.0.5 The skill provides a utility to configure NVIDIA models in OpenClaw securely. The included Python script (`scripts/merge_nvidia_config.py`) automates the setup of API keys using environment variables and systemd user overrides, following security best practices such as setting file permissions to 600 and using SecretRefs instead of plaintext. The documentation in `SKILL.md` is clear and aligns with the script's functionality, with no evidence of malicious intent, data exfiltration, or significant vulnerabilities.