OpenClaw JSON Editing Masterclass

Advanced editing of OpenClaw JSON5 configs with schema validation, merge patching, env var substitution, and type-safe modifications using jq.

This skill appears intended to edit OpenClaw configuration files and handle env-var substitution, but its metadata and documentation don't line up. Before installing: 1) Ask the publisher why jq is required and request concrete examples showing how jq is used (or remove jq if unused). 2) Confirm whether the agent will read files under ~/.openclaw and environment variables (including API keys) at runtime — those are sensitive. 3) If you plan to use it, run the skill in a sandbox or with limited test configs first, and back up ~/.openclaw. 4) Prefer an updated SKILL.md that lists required binaries/CLI tools, enumerates any environment variables it will read, and provides explicit commands the agent will run so you can verify there is no unexpected exfiltration of secrets.

Type: OpenClaw Skill Name: openclaw-json-editing Version: 1.0.0 The skill bundle is designed for legitimate OpenClaw configuration management, including editing JSON, handling environment variables, and configuring AI model providers. However, it is classified as 'suspicious' due to the inclusion of a `jq` command (`jq '.. | objects | .apiKey? // .token? // .password? | select(.)' ~/.openclaw/config.json`) explicitly designed to 'Deep search for all API keys (for audit)' within configuration files (SKILL.md). While framed as an audit tool, this command directly targets and extracts highly sensitive credentials. An AI agent executing this command, especially if susceptible to prompt injection, could easily be instructed to exfiltrate the collected secrets, representing a significant data exposure vulnerability. Additionally, the skill demonstrates the agent's ability to make external network requests using `curl` with API keys from environment variables, further highlighting its high-risk capabilities.