openlist

Execute safe file operations via OpenList API with preview-apply workflow for browsing, moving, renaming, deleting, offline tasks, and audit logging.

This skill appears to implement the OpenList preview-then-apply workflow and uses OPENLIST_BASE_URL and OPENLIST_TOKEN — which is appropriate — but the registry metadata incorrectly lists no required env vars. Before installing: (1) verify the skill's source/trustworthiness (homepage unknown, owner ID only), (2) ensure OPENLIST_TOKEN you provide is scoped minimally (not a full admin token if not needed), (3) understand that the script will read .env at the repository root and skills/openlist/.env (remove or audit those files first to avoid leaking unrelated secrets), (4) review the full openlist.py source to confirm there are no unexpected network calls or telemetry, and (5) run the skill in an isolated environment or with a token that has only the necessary permissions. If the publisher can correct the registry metadata and explicitly document .env reading and audit contents/redaction behavior, that would reduce concern.

Type: OpenClaw Skill Name: openlist-skill Version: 1.0.0 The OpenList skill is a well-architected tool for managing file operations via an API, featuring robust safety mechanisms such as a mandatory 'preview-and-apply' workflow and comprehensive plan validation. It includes proactive security measures like endpoint allowlisting, path normalization, and an audit logging system (scripts/openlist.py) that redacts sensitive credentials. The instructions in SKILL.md explicitly guide the AI agent to seek user confirmation and provide warnings for destructive actions, demonstrating a clear focus on safe and auditable operation.