OAuth Providers

Adds an "OAuth" settings tab to the OpenClaw Control UI for connecting AI model providers. Supports Anthropic Claude Pro/Max subscription tokens (setup-token...

This skill appears to do what it says: add an OAuth/API-key UI and store credentials in OpenClaw's auth and secrets stores. Before installing, consider the following: - It will read ~/.claude/.credentials.json (Claude CLI) if you use the Anthropic auto-detect feature and copy that token into OpenClaw — only enable auto-detect if you trust this behavior. - Credentials are written to OpenClaw config/secrets (auth-profiles.json, ~/.openclaw/secrets.json). Make backups if you want to revert changes. - OAuth manual fallback requires pasting the full redirect URL (contains codes/state). Avoid pasting such URLs into untrusted UIs or shared clipboards. - The gateway uses a third-party package (@mariozechner/pi-ai) via dynamic import; ensure that dependency in your environment comes from a trusted source before using the OAuth flow. - Logs may include short token prefixes in error messages (the code prints the token start in some errors). If that concerns you, review/modify logging before use. If you are comfortable with these behaviors (reading Claude CLI creds, writing to OpenClaw auth/secrets, and relying on the external pi-ai package), the skill is coherent with its stated purpose. If you need higher assurance, review the included TypeScript files and the provenance of @mariozechner/pi-ai before enabling the feature.

Type: OpenClaw Skill Name: oauth-providers Version: 1.1.0 The skill provides legitimate AI provider credential management but employs high-risk capabilities, such as reading sensitive access tokens from the Claude CLI configuration file (~/.claude/.credentials.json) and instructing the AI agent to execute Python scripts and system commands (systemctl) for troubleshooting. While these actions are aligned with the stated purpose and lack evidence of malicious intent or data exfiltration, the direct access to external application secrets and the use of agent-led shell execution for configuration management meet the criteria for a suspicious classification under the provided rubric.