A decision helper that helps users decide whether to participate in an airdrop campaign. Use when the user considers joining an airdrop. Prompt-only.

This skill's documentation says it's prompt-only and needs nothing, but the included handler.py tries to read /Users/jianghaidong/.openclaw/skills/{skill_name}/SKILL.md using an unsanitized skill_name. That mismatch is suspicious — it may be an accidental leftover from development, but it also allows local file reads (and potentially directory traversal) which could leak sensitive files. Before installing or enabling: 1) Ask the publisher why the code reads a hard-coded home path and request removal of any local-file reads unless explicitly needed. 2) If you or a reviewer will run the code, inspect/modify handler.py to (a) avoid hard-coded paths, (b) sanitize/validate skill_name (reject path separators), or (c) remove _load_skill_meta entirely and use the packaged SKILL.md via safe APIs. 3) Run the skill in a sandboxed environment if you must test it, and verify there are no network calls and it doesn't read sensitive files. 4) If you can't get a satisfactory explanation or patch, treat the skill as untrusted and avoid installing it in environments with sensitive data. The current state is likely a coding oversight but is not justified by the skill's description, so proceed with caution.

Type: OpenClaw Skill Name: airdrop-participation-filter Version: 1.0.0 The skill contains a hardcoded absolute path to a specific local user directory (/Users/jianghaidong/.openclaw/skills/) in handler.py. This implementation is highly irregular for a portable skill and introduces a path traversal vulnerability because the 'skill_name' parameter is used to construct file paths without sanitization. While the current code reads the file but does not exfiltrate its content, the presence of environment-specific paths and insecure file handling warrants a suspicious classification.