Runtime Debugging Skill

Diagnose and fix bugs using runtime execution traces. Use when debugging errors, analyzing failures, or finding root causes in Python, Node.js, or Java appli...

Key things to consider before installing or following these instructions: - Source verification: There is no homepage or clear publisher provenance. Verify the upstream project/repo (Syncause) and its maintainers before running any installers. - Don’t run remote installers blindly: Inspect any shell script downloaded via curl|bash and review the contents of packages pulled by npx/@syncause and the wheel URL before executing or adding them to your project. - Avoid global config edits unless you understand them: The MCP install docs propose writing to many project and global IDE files (~/.vscode, ~/.claude, ~/.codex, etc.). Prefer project-level, reviewable changes and avoid modifying global user configs without consent. - Secrets handling: The docs show placing API_KEY and other tokens into configs and even include hard-coded tokens in the Java example. Do not commit secrets into repo files. Ask the author why example tokens are present and replace with secure secret storage (env vars, secret managers) and ensure tokens are rotated if they were ever published. - Prefer pinned versions and reproducible installs: Unpinned 'latest' npx installs and curl|bash patterns are risky. Ask for SHA-verified releases or package-versioned installs instead. - Code modifications: The skill instructs injecting initialization code into entrypoints and generating a manual installation patch (with advice to avoid git diff). This is unusual; insist on clear diffs and code-reviewable commits so changes are auditable and reversible. If you decide to proceed for testing, do so in an isolated environment (ephemeral VM/container) and audit the downloaded artifacts first. If you can, request the publisher to declare required env vars and provide verifiable release artifacts (GitHub repo + signed release, or published packages with pinned versions) and remove any hard-coded tokens from documentation.

Type: OpenClaw Skill Name: runtime-debugging-skill Version: 0.1.0 The skill bundle is classified as suspicious due to several high-risk security practices and invasive requirements. It instructs the agent to install a 'Syncause SDK' using insecure methods, including a 'curl | bash' command in 'references/install/nodejs.md' and the use of hardcoded GitHub Personal Access Tokens (PATs) in 'references/install/java.md' to access private repositories. The SDK utilizes bytecode manipulation and runtime tracing to send application data to a remote websocket (wss://api.syn-cause.com). While these capabilities are framed as debugging features, the combination of hardcoded credentials, remote script execution, and instructions in 'SKILL.md' to manipulate the agent's reporting behavior presents a significant security risk and potential for abuse.