Skill

一键部署静态网站到阿里云 OSS。当用户说「部署」「发布」「上线」「deploy」「重新配置」「更新凭证」「更换 AccessKey」时触发。

This skill appears to implement a legitimate OSS deploy workflow, but take precautions before installing/using it: - Be aware the skill will ask you to paste your Alibaba AccessKey ID and Secret directly into the conversation. Conversation logs may persist — avoid pasting production/root keys into chat. Prefer creating a temporary RAM user with limited, least-privilege policies and use that key. - The skill will write credentials to ~/.ossify/auth.json in plaintext. If you use it, review that file, consider encrypting or deleting it after use, and verify file permissions. - The SKILL.md assumes node/npm, Bash, and a browser-devtools MCP tool are available, but the manifest does not declare these requirements — ensure these tools exist and understand the commands the skill will run (it may install global npm packages). If you prefer more control, use the manual mode and perform account/key creation yourself rather than enabling the automatic browser automation. - Review the requested RAM policies (AliyunOSSFullAccess, AliyunDNSFullAccess, AliyunCDNFullAccess). Grant only the permissions you actually need; for simple uploads OSS-only may be enough. - If you need higher assurance: run the skill in a disposable environment, use temporary keys, or manually follow the guide/index.html steps and avoid pasting credentials into chat. Given the secret-handling and undeclared runtime-tool assumptions, this skill is coherent with its purpose but presents practical privacy/operational risks — proceed cautiously.

Type: OpenClaw Skill Name: ossify-deploy Version: 1.0.4 The skill automates static site deployment to Alibaba Cloud OSS but employs high-risk credential handling and automation patterns. In SKILL.md, it instructs the agent to use Chrome DevTools MCP to automate the creation of RAM users and grant broad administrative permissions (AliyunOSSFullAccess, AliyunDNSFullAccess, AliyunCDNFullAccess). It also explicitly directs the user to paste sensitive AccessKey Secrets into the chat interface and uses 'node -e' shell execution to write these credentials to a local file (~/.ossify/auth.json). While these actions are aligned with the stated purpose of a 'one-click' deployment tool, the automation of IAM policies and the handling of secrets in plain text within the agent's prompt history represent significant security risks.