NewAPI

Assistant for newapi (new-api), an open-source unified AI gateway platform (https://github.com/QuantumNous/new-api). Use when the user asks about New API, ma...

Before installing or running this skill: 1) Be aware the scripts require NEWAPI_BASE_URL, NEWAPI_ACCESS_TOKEN, and NEWAPI_USER_ID even though the registry metadata doesn't list them — set those only in a secure environment. 2) env.js will load .env from your project root (it searches upward from the current working directory) and from the skill dir — remove or avoid sensitive secrets in project .env files you don't want read. 3) Review the scripts yourself: inject-key can overwrite files atomically and exec-token runs arbitrary shell commands with live secrets substituted; only run apply/exec on files/commands you trust. 4) The skill's sanitizers try to redact secrets but are heuristic — do not rely on them as an absolute guarantee. 5) If you expect the platform to enforce least privilege, ask the publisher to update metadata to declare required env vars explicitly and to document the .env file access behavior clearly before proceeding.

Type: OpenClaw Skill Name: newapi Version: 0.1.1 The skill bundle provides management for the New API gateway but includes high-risk capabilities, specifically arbitrary shell command execution and file system modification. The script `exec-token.js` uses `execSync` with `shell: true` to execute commands containing token placeholders, which presents a significant Remote Code Execution (RCE) risk if the command template is manipulated. Additionally, `inject-key.js` allows for reading and atomically overwriting local files. While the bundle contains extensive security instructions and a sanitization module (`sanitize.js`) designed to prevent the AI from seeing or leaking secrets, the inclusion of these powerful execution primitives without strict input validation qualifies as suspicious.