OpenClaw API Control

Control a hosted OpenClaw instance through the OpenClaw as a Service API. Use when the user asks to talk to OpenClaw over API, send a folder or file to OpenC...

This package appears to be a straightforward OpenClaw API client and the code matches the documented commands, but there are notable red flags to consider before installing: - The SKILL.md and script require OPENCLAW_API_KEY (and optionally OPENCLAW_API_BASE_URL / OPENCLAW_INSTANCE_ID), yet the registry metadata listed no required credentials — ask the publisher to correct the registry metadata and explain why it was omitted. - The script will read and upload local files when you explicitly request 'upload-tree' or similar; it enforces a 5MB per-file limit and skips likely binaries, but it will transmit whatever you point it at to the configured API_BASE_URL. Ensure OPENCLAW_API_BASE_URL is the official endpoint before uploading sensitive files. - Only provide an API key scoped to the minimum privileges and instances needed; consider creating a test key and rotating it after validating the skill. - The owner and homepage are unknown. Prefer skills from known publishers or with an audit trail; request provenance (author email, repo, or signed release) and review the full script yourself or have a trusted party do so. - Because the manifest/metadata mismatch is the primary concern, ask the maintainer to fix the metadata (declare OPENCLAW_API_KEY as a required credential) and re-publish. If you cannot verify the source or correct the metadata, run the skill in a sandboxed environment and avoid uploading sensitive data. If you want, I can list the exact lines where the code reads OPENCLAW_API_KEY and where file uploads occur so you can inspect them further.

Type: OpenClaw Skill Name: openclaw-api-control Version: 0.1.1 The skill provides a Node.js client (scripts/openclaw_api_client.mjs) to manage remote OpenClaw instances via an API. It includes high-risk capabilities such as recursive local file reading and uploading (upload-tree) and remote command execution (terminal exec) on the target instance. While these behaviors are aligned with the stated purpose in SKILL.md and require a user-provided OPENCLAW_API_KEY, the broad file and network access to the default endpoint (openclaw-as-a-service.com) constitutes a significant attack surface for data exfiltration if misused.