OpenClaw confluence

Full Confluence Cloud REST API v2 skill (pages, spaces, folders, databases, whiteboards, comments, labels, tasks, properties, etc.) with basic/OAuth auth, pagination, and migration from confluence-cli.

This skill appears to be a full Confluence v2 client and the scripts are generally consistent with that purpose, but there are two practical concerns: (1) the skill actually requires Confluence credentials (email + API token or OAuth token and a base URL) even though the registry metadata lists none — expect to provide sensitive env variables if you use it; (2) the included migration script will read ~/.confluence-cli/config.json and write a .env file inside the skill folder, which can copy credentials from your home directory into a file the skill loads. Before installing: verify the publisher/source, review the scripts (especially migrate-from-confluence-cli.js and scripts/client.js), avoid placing long-lived credentials in global scopes, consider running the skill in an isolated environment, and if you use the migration script inspect ~/.confluence-cli/config.json to ensure it only contains what you intend to export. If you are uncomfortable with a bundled script reading/writing files in your home directory, do not install or run the migration step.

Type: OpenClaw Skill Name: openclaw-confluence-skill Version: 1.0.0 The skill is suspicious due to its explicit instruction in SKILL.md and implementation in scripts/migrate-from-confluence-cli.js to access and read a sensitive configuration file located outside the skill's directory, specifically `~/.confluence-cli/config.json`. This script parses the file to extract Confluence credentials (domain, email, API token) and writes them into the skill's local `.env` file. While the stated intent is 'migration' and not external exfiltration, accessing sensitive user files from the home directory without explicit, granular consent is a high-risk behavior and a privacy concern.