Vestaboard

Read and write messages on a Vestaboard using the Vestaboard Cloud API (cloud.vestaboard.com) and optional legacy RW endpoint. Use when asked to display text on a Vestaboard, update a sign/board, show a short status message, render simple pixel-art using color/filled character codes, or retrieve the current board message.

This skill appears to be what it says (a Vestaboard client) and its code is readable. However: (1) the registry metadata incorrectly shows no required environment variables — in reality you must provide VESTABOARD_TOKEN (or legacy VESTABOARD_RW_KEY) and optionally VESTABOARD_API_BASE; verify and supply those securely (do not commit them). (2) Review scripts/vb.js and ENV.md yourself before running npm install. (3) Ensure your node runtime meets the undici requirement (Node >= 20.18.1). (4) If you enable autonomous invocation for an agent, be aware the agent could call the Vestaboard API whenever the skill is invoked; only grant the token to agents you trust. If the metadata omission is accidental, request the publisher update the registry entry to declare the required credentials before installing.

Type: OpenClaw Skill Name: vestaboard Version: 1.0.0 The skill is suspicious due to a risky capability in `scripts/vb.js`. The `vbWriteLayout` function reads a file path directly from command-line arguments using `readFileSync`. While intended for Vestaboard layout files, this allows an AI agent (if compromised via prompt injection) to be instructed to read arbitrary local files (e.g., `/etc/passwd`, `~/.ssh/id_rsa`) and attempt to send their content to the Vestaboard API endpoint (cloud.vestaboard.com). This presents a potential data exfiltration vector, even though the skill itself does not exhibit clear malicious intent.