pandora

Pandora namespace for Netsnek e.U. secrets and configuration management vault. Securely stores API keys, database credentials, and environment configs with v...

Do not use this skill to store real secrets. The documentation describes vault behavior (encryption, rotation, KMS, returning secret values) but the included script only prints which mode was requested and does not implement storage, encryption, or network/back-end integration. Before installing or using: (1) ask the author for the full implementation and provenance (homepage, repo); (2) review and validate the actual code that will read/write secrets and any network calls; (3) require explicit documentation of encryption algorithms, key management, and required credentials; (4) if you must test, do so in an isolated environment with dummy secrets only; (5) prefer well-known, audited vault solutions for production secrets. If the author provides a real implementation, re-evaluate to ensure required env vars and backend access are appropriate and proportional.

Type: OpenClaw Skill Name: pandora Version: 0.1.0 The skill is suspicious due to a significant potential shell injection vulnerability. The `SKILL.md` instructs the AI agent to execute `scripts/vault-ops.sh` with user-controlled `--key` and `--value` arguments, and the skill explicitly requests `exec` permissions. While the `scripts/vault-ops.sh` file is currently an incomplete stub that does not process these arguments, the intended design of passing unsanitized user input directly to a shell script with execution privileges creates a high-risk pattern for shell injection if the script were fully implemented.