OpenClaw Kazakh IME

为 OpenClaw 和网页提供哈萨克语输入法，支持英文、阿拉伯文和西里尔文三种输入模式及虚拟键盘切换。

This skill appears coherent for a browser-based IME, but installing a script into an app's UI gives it runtime access to typed input. Before installing: (1) review the full openclaw-kazakh-ime.js file for any network calls, eval/Function usage, obfuscated strings, or code that sends data off-host; (2) verify the GitHub repository and that the source matches the packaged JS; (3) back up the index.html you will edit and test the script in an isolated environment or non-production profile; (4) confirm the script does not attach to password inputs or other sensitive fields (and if needed, modify it to ignore input[type=password] and other sensitive selectors); (5) prefer installing via an official plugin mechanism or vetted distribution if available. If you want, I can scan the full JS for network/XHR/fetch usage and suspicious patterns or summarize any risky code paths.

Type: OpenClaw Skill Name: openclaw-kazakh-ime Version: 1.3.0 The skill bundle implements a Kazakh Input Method Editor (IME) but employs a high-risk installation procedure. SKILL.md instructs the agent to modify the core OpenClaw application files (specifically index.html within the npm node_modules directory) to inject a custom JavaScript file (openclaw-kazakh-ime.js). While the script itself appears to be a functional IME without evidence of data exfiltration or malicious payloads, the instruction to modify the host application's distribution files for persistence and UI injection is a high-risk behavior that bypasses standard security boundaries.