pass - stores, retrieves, generates, and synchronizes passwords securely

Complete guide for using pass, the standard Unix password manager. Use this skill whenever the user asks about pass, password-store, managing passwords from...

This skill is essentially documentation and appears consistent with its purpose. Before running any of the commands shown: (1) review them line-by-line and understand their effects (especially git push, gpg --import, pass rm, and pass grep which decrypts data); (2) back up your store and private keys before making changes; (3) never paste your GPG private key or decrypted passwords into untrusted places; (4) ensure any remote repo you push to is private and you intend to host secrets there; and (5) if an automated agent attempts to execute these commands on your behalf, do not grant it access to your GPG private key or to the filesystem holding ~/.password-store unless you explicitly trust the agent and environment.

Type: OpenClaw Skill Name: pass Version: 1.0.0 The skill provides a comprehensive guide for the `pass` password manager, including installation and usage instructions. While the core functionality and most commands are benign and directly related to the stated purpose, the skill is classified as suspicious due to instructions for installing the `pass-update` extension. This involves a `git clone` command to fetch a shell script (`update.bash`) from a third-party GitHub repository (https://github.com/roddhjav/pass-update) into the user's system. Although `pass-update` is a legitimate extension, this method of installation introduces a supply chain risk for the user, as the integrity of the external repository is not guaranteed by the skill itself, representing a risky capability without clear malicious intent. This instruction is found in `SKILL.md`.