passnote-skill

Create and manage disposable memos using PassNote. Share secure, auto-destructing notes with others.

This skill appears to do what it says (post memo content to your PassNote service and return a passcode/link), but verify a few things before installing: - Fix or confirm the metadata: the registry metadata incorrectly lists no required env vars, but the SKILL.md and script require PASSNOTE_API_URL and PASSNOTE_API_TOKEN. Ensure your platform will provide those env vars. - Only provide a token scoped for this purpose. Create a dedicated, minimal-permission API token on your PassNote instance rather than using an admin/global token. - Confirm the PASSNOTE_API_URL value is a service you control or trust. The script will send whatever content you provide to that URL; do not point it to an untrusted endpoint. - Be aware the script prints the passcode and link to stdout. Those outputs could be captured in logs or command history; treat them as sensitive and avoid putting secrets in shared logs. - If you have concerns, run the script locally (with a test token and test data or against localhost) to observe its network calls and responses before enabling agent automation. If these checks are acceptable, the skill itself is coherent with its stated purpose; the main issues are metadata accuracy and usual token/endpoint trust considerations.

Type: OpenClaw Skill Name: passnote Version: 1.0.3 The PassNote skill is a legitimate tool for creating secure, self-destructing memos. The Python script (scripts/create_memo.py) uses standard libraries to interact with a user-defined API endpoint and does not contain any malicious logic, data exfiltration, or obfuscation. The instructions in SKILL.md and README.md are consistent with the stated purpose and do not attempt to manipulate the agent into performing unauthorized actions.