Standard SAPCONET SSH command templates for bird reads, Puppeteer runs, and inbox messaging workflows.

This skill is a lightweight SSH template but has a few red flags: (1) it expects SAPCONET_TARGET but the metadata doesn't declare it — set this yourself before running (e.g. export SAPCONET_TARGET='user@host'). (2) The scripts default to a hard-coded IP ([email protected]); update it to your intended host. (3) Do not pass untrusted input to scripts/msg-sapconet.sh as MESSAGE is expanded without safe escaping — an attacker-controlled message could inject commands to run on the remote host. Sanitize or properly quote inputs (or use ssh and printf %q, or pass the message via stdin). (4) Ensure SSH authentication is handled via your standard SSH keys/agent; the skill does not manage credentials. (5) Review and adapt the placeholder commands carefully before running them. If you need help hardening the scripts (declaring required env, safer quoting, explicit key usage), consider asking for a revised version that properly escapes variables and documents required environment variables.

Type: OpenClaw Skill Name: billy-sapconet-ssh-bridge Version: 0.1.0 The skill bundle provides SSH command templates for interacting with a SAPCONET host. While it uses SSH, an inherently powerful command, this is central to its stated purpose as an 'SSH bridge'. The `SKILL.md` documentation clearly outlines the purpose, includes safety rules, and explicitly warns about 'TODO' placeholders in the scripts, instructing the user/agent to review them. There is no evidence of intentional harmful behavior, data exfiltration, obfuscation, or malicious prompt injection attempts against the agent. The 'TODO' placeholders represent an incompleteness in the templates, which could lead to functional errors if executed without modification, but do not indicate malicious intent.