DocuSign e-signatures — manage envelopes, templates, recipients, and signing via REST API

This skill appears to be a straightforward DocuSign CLI, but there are a few surprises you should consider before installing: - Inconsistency: SKILL.md requires DOCUSIGN_BASE_URL, but the script hardcodes the demo API base and never uses that env var. Expectation and implementation don't match — confirm which base URL you should supply and why the variable is declared. - Hidden file read: If DOCUSIGN_ACCESS_TOKEN or DOCUSIGN_ACCOUNT_ID are not set in the environment, the script will try to read them from a .env file in a workspace directory (WORKSPACE or ~/.openclaw/workspace/.env). That behavior is undocumented in the README and could expose other secrets stored in your workspace .env file. - Arbitrary URL support: The code will accept full http(s) paths (if path starts with "http") when making requests. While necessary for flexibility, this could be misused if accidental inputs are provided — validate inputs if you plan automated use. Recommendations: - Inspect the script yourself or run it in an isolated environment. Ensure your .env workspace files do not contain unrelated secrets, or remove/secure them if you will run this skill. - If you need to use a non-demo DocuSign base URL, contact the skill author or patch the script to respect DOCUSIGN_BASE_URL (or update SKILL.md to match the implementation). - Prefer setting DOCUSIGN_ACCESS_TOKEN and DOCUSIGN_ACCOUNT_ID explicitly in the environment rather than relying on .env fallback. Given these mismatches and the undocumented workspace .env read behavior, proceed only after you confirm the intended base URL behavior and secure any workspace .env files.

Type: OpenClaw Skill Name: docusign Version: 1.0.0 The skill is a straightforward CLI wrapper for the DocuSign API, using only Python's standard library. It retrieves required API credentials (access token, account ID) from environment variables or a `.env` file located in the OpenClaw workspace (`~/.openclaw/workspace`). While reading from a `.env` file is a non-standard way to get environment variables, it's confined to an expected OpenClaw path and for its own required configuration, not arbitrary sensitive files. The script hardcodes the API base URL to `demo.docusign.net`, which is a functional bug given `DOCUSIGN_BASE_URL` is listed as a requirement in `SKILL.md`, but this is not a security vulnerability. There is no evidence of data exfiltration, malicious execution, persistence, prompt injection, or obfuscation.