Автоматически отвечает на вопросы и проблемы в чатах FunPay, уведомляет о входе в аккаунт и пересылает неопознанные сообщения владельцу.

Do not install/run this skill as-is. Key concerns: (1) monitor.py contains a hard-coded FunPay API key (GOLDEN_KEY) that is not declared in metadata — this exposes an account and gives the skill direct access to chats; (2) the bundle includes state.json with many real chat messages (sensitive data); (3) the description promises Telegram notifications but there is no Telegram integration or declared token, so functionality and data flows are unclear; (4) invisible/control characters were detected which can hide content. If you want to use a similar tool safely, ask the author to: remove the hard-coded key and require a documented environment variable (e.g., FUNPAY_API_KEY), scrub or omit any bundled chat logs, implement and document Telegram integration (and require TELEGRAM_BOT_TOKEN/CHAT_ID), publish installation steps and the FunPayAPI dependency, and explain exactly what data is sent externally. If you already ran this code using your environment, rotate any exposed FunPay credentials immediately and audit account activity. If the embedded key appears to belong to someone else, do not use it — contact the owner or treat the bundle as untrusted.

Type: OpenClaw Skill Name: funpay-assistant Version: 1.0.0 The skill is classified as suspicious due to a hardcoded API key (`GOLDEN_KEY` in `monitor.py`), which is a significant security vulnerability. Additionally, the `monitor.py` script automates a social engineering tactic by offering to log into a customer's account (`REGION_ERROR_REPLY`) and then implicitly exfiltrates all non-order-confirmation chat messages and customer agreements to account access (via `print` statements) to the owner, relying on the OpenClaw agent to forward these to an external channel like Telegram as stated in `SKILL.md`. While the data exfiltration is to the owner and for the stated purpose, the combination of a hardcoded secret and automation of risky social engineering tactics warrants a 'suspicious' classification.