Orgo Desktop Control

Provision and control Orgo cloud computers using the orgo_client Python SDK. Use when launching remote desktops, automating browsers, running bash/python rem...

This package implements a client for a remote desktop/cloud VM service (orgo.ai) and will need an ORGO_API_KEY and internet access to function — but the registry metadata did not declare that requirement. Before installing: (1) confirm the skill's origin and trustworthiness (no homepage is listed); (2) ensure any ORGO_API_KEY you provide is scoped minimally (limited permissions, revocable) and not your primary personal or cloud credentials; (3) be aware the skill can upload local files and retrieve VNC passwords and signed download URLs (so avoid uploading secrets or sensitive files unless you trust the service); (4) check billing/usage implications of creating remote machines; (5) if you need to enforce policy automatically, add ORGO_API_KEY to allowlists and/or deny the skill until metadata is corrected. If you want higher assurance, request the publisher to update registry metadata to declare ORGO_API_KEY as a required credential and provide a verifiable homepage or source repository.

Type: OpenClaw Skill Name: orgo-desktop-control Version: 1.0.2 The skill bundle is classified as suspicious due to its broad and powerful capabilities, which, while explicitly stated as its purpose, introduce significant security risks. The `scripts/orgo_client.py` library allows for arbitrary remote code execution (`run_bash`, `run_python`) on cloud computers, local file upload (`upload_file`) from the agent's host machine to the Orgo cloud, and retrieval of sensitive information like VNC passwords. While the `SKILL.md` and `references/ORGO_ACTION_PATTERNS.md` openly declare these features and include safety instructions, these capabilities create a substantial attack surface for prompt injection or misuse, potentially leading to unauthorized local file exfiltration or remote system compromise if the agent is tricked into executing malicious commands.