OpenAI Auth Switcher Public

Web-first, publishable OpenClaw skill for OpenAI OAuth account switching. Use when you need a reusable public-track workflow for first-run takeover, environm...

This package is credential-adjacent and will read/write local OpenClaw auth files and manage a user-level service. Before installing: 1) Review service/app.py and any network/telemetry code (hourly_usage.py) to confirm nothing phones home or exposes tokens. 2) Inspect scripts that copy or restore auth-profiles.json (scripts/auth_file_lib.py, scripts/import_auth_file.py) to ensure import behavior is intentional and safe. 3) Run doctor.py and env_detect.py in --json mode on an isolated/test machine first. 4) Set OPENAI_AUTH_SWITCHER_PUBLIC_STATE_DIR to an external test directory (per docs) to avoid polluting the source tree. 5) Backup existing auth-profiles.json and related OpenClaw state before any import/switch operations. 6) If you do not trust the author or cannot audit the code, do not run install.sh on production hosts — prefer running in a sandbox or VM and use the packaging wrapper (package_public_skill.py) to inspect artifacts before publishing or deploying.

Type: OpenClaw Skill Name: openai-auth-switcher-public Version: 0.3.1-preview This skill functions as an OpenAI authentication manager that can swap, backup, and monitor OAuth tokens within the OpenClaw environment. While it aligns with its stated purpose, it is classified as suspicious due to high-risk capabilities: it implements a persistent web server (service/app.py) that provides a remote/local interface for manipulating sensitive credentials, installs a systemd user service for persistence (scripts/install_web_app.py), and includes functions to import/export auth profiles from the local filesystem (service/channel_store.py). The web server is protected by basic auth and binds to localhost by default, but the inherent risk of a background service managing API tokens, combined with terminology like 'account takeover' in SKILL.md, warrants caution.