Userorbit

Manage Userorbit resources via the public API. Create and manage feedback, announcements, roadmap topics, help center articles, boards, tags, subscribers, an...

This skill appears to do exactly what it claims: call the Userorbit REST API using USERORBIT_API_KEY and USERORBIT_TEAM_ID. Before installing, consider: 1) Treat the API key as a sensitive secret — the skill can make any API call permitted by that key (create/delete/update actions are included in the API surface). 2) If Userorbit supports scoped or read-only tokens, prefer using a token limited to needed actions. 3) There is no install step or third-party download, and the only shipped code is a small curl wrapper. 4) The skill's source/homepage is not provided in the metadata; if you require provenance, ask the publisher for a canonical repository or documentation. 5) If you allow autonomous invocation, understand the skill could perform write operations on your behalf; consider restricting invocation or auditing actions if you are worried about destructive changes.

Type: OpenClaw Skill Name: userorbit Version: 1.1.1 The skill bundle contains a shell injection vulnerability in the `api-helper.sh` script. The script passes the `$ENDPOINT` variable directly into a `curl` command string without sanitization, which could allow for arbitrary command execution if the input is manipulated. While the bundle's stated purpose of managing Userorbit resources via `https://api.userorbit.com/api/v1` appears legitimate, the insecure handling of shell arguments poses a security risk.