Otp Challenger

Enable agents and skills to challenge users for fresh two-factor authentication proof (TOTP or YubiKey) before executing sensitive actions. Use this for identity verification in approval workflows - deploy commands, financial operations, data access, admin operations, and change control.

This skill appears to implement what it claims, but review these items before installing: 1) Inspect verify.sh (and related scripts) yourself to confirm there are no unexpected network endpoints beyond api.yubico.com and no hidden behavior. 2) Don’t set OTP_FAILURE_HOOK to an unrestricted or destructive script; prefer a safe notifier (append-only logging or an alert sender) and lock its file permissions. 3) Keep OTP_SECRET and YUBIKEY_SECRET_KEY in a secure secret manager (1Password/Bitwarden) and avoid plaintext in ~/.openclaw/config.yaml when possible. 4) Verify the skill source — SKILL.md references a GitHub repo, but the registry metadata shows no homepage; prefer installing from a verified upstream repository (and check commit history/signature). 5) Run the scripts in a controlled environment or sandbox first, and review audit logs after test runs. If you rely on autonomous agent invocation, be extra cautious about enabling any hook that executes commands.

Type: OpenClaw Skill Name: otp-challenger Version: 1.0.6 The skill is classified as suspicious due to the `OTP_FAILURE_HOOK` in `verify.sh` and `SKILL.md`. This hook is explicitly documented as a 'privileged feature' that 'can execute arbitrary shell commands on failure events' and is directly executed via `$FAILURE_HOOK &`. While intended for legitimate administrative actions (e.g., alerts, agent shutdown), this constitutes a direct Remote Code Execution (RCE) vulnerability if the `OTP_FAILURE_HOOK` environment variable is controlled by an attacker or set to an untrusted value. The skill otherwise demonstrates strong security practices, including robust input validation, secure YAML parsing, atomic file operations, and replay protection, as detailed in `otp-skill-summary.md`.