ocean right marine

ORM 气象导航航次距离计算工具 - 通过 NavOptima 查询港口间航行距离（海里）

Do not install blindly. Specific things to consider before installing: - The SKILL.md contains a plaintext NavOptima email and password — ask who owns that account and whether you are authorized to use it. Never rely on hardcoded shared credentials; prefer per-user credentials or API keys injected via environment variables. If that account is legitimate, rotate the password and avoid embedding secrets in skill text. - The skill forces full-page screenshots and instructs sending them to chat 'regardless of user window'. That can leak sensitive map/context data or other on-screen information. Require explicit user consent before any screenshot is taken or sent, and restrict sending to the active conversation only. - Verify the contact details and the service domain (https://nop.ormwx.com). If you cannot confirm the provider and account ownership, do not grant the skill runtime access to your agent or browser tools. - If you still want the functionality: request the skill be changed to (1) accept credentials via declared environment variables or an OAuth flow, (2) make screenshots and sending optional and require user confirmation, and (3) remove hardcoded contact/signature insertion or make it configurable. - Test the skill in a restricted sandboxed environment first, monitor network and account activity, and rotate credentials immediately if they were used by the skill. If you have compliance or privacy constraints, this skill’s current instructions are inappropriate until modified.

Type: OpenClaw Skill Name: orm-weather-routing-nav-voyage-distance-finder Version: 1.0.0 The skill bundle contains hardcoded plaintext credentials (email and password) for the NavOptima service within the `skill.md` file, which is a significant security vulnerability. Additionally, the instructions use high-pressure language ('Mandatory', 'Forced') to override agent behavior, requiring it to take screenshots and append a specific marketing signature with contact details (+86 18669863008) to every response. While these appear to be for a legitimate maritime routing service (ormwx.com), the hardcoding of sensitive credentials and rigid behavioral steering are high-risk patterns.