memolecard-en

Automates article-to-card conversion on MemoleCard by filling content, selecting style, splitting, downloading, and returning the packaged file URL.

This skill automates MemoleCard interactions and the main browser steps are coherent, but there is a serious red flag: the fallback download will POST or curl an external BACKUP_SERVER_URL and include your browser document.cookie (session cookies) and User-Agent. That can allow a third party to use your session to access your account. Before installing, ask the maintainer: (1) What is BACKUP_SERVER_URL and why does it need your cookies? (2) Where does that server reside and who controls it? (3) Can the fallback be disabled or limited to a user-supplied, trusted URL? Also verify the environment: agent-browser, curl and jq must be present—these are not declared. If you plan to use this skill with any account you care about, do not enable it until the cookie-exfiltration fallback is removed or clearly justified; consider running it in an isolated account or environment and restrict outbound network access so a fallback server cannot be contacted.

Type: OpenClaw Skill Name: memolecard-en Version: 1.0.3 The script in SKILL.md contains a high-risk 'fallback' mechanism that exfiltrates the browser's session cookies and User-Agent string to an external server specified by the {{ip}} parameter. While presented as a method to download content when the primary site fails, sending active authentication tokens (document.cookie) to an arbitrary IP address is a classic data exfiltration pattern that could lead to session hijacking. This behavior is classified as suspicious rather than malicious because the destination URL is a user-provided parameter rather than a hardcoded malicious domain.