Placed Interview Coach

This skill should be used when the user wants to "practice interview", "mock interview", "prepare for interview", "system design interview", "behavioral inte...

This skill otherwise looks coherent for calling the Placed API, but take these precautions before installing or using it: - Expect to provide a Placed API key: the SKILL.md uses PLACED_API_KEY though the registry metadata doesn't declare it. Only provide a key if you trust https://placed.exidian.tech. - Prefer exporting PLACED_API_KEY in your environment rather than letting the skill write it to disk. If you do allow the skill to save the key, create the file yourself and set restrictive permissions (chmod 600 ~/.config/placed/credentials). - Be cautious of copy-pasting the exact echo commands: they place raw input into a shell command. If you follow those steps, ensure the key is properly quoted/escaped to avoid accidental shell interpretation. - Verify the service domain and its privacy/security posture (who runs placed.exidian.tech, where tokens are stored, data retention). If you have sensitive resumes or private data, confirm how the service will use/store them. If the publisher can update the registry metadata to declare PLACED_API_KEY as a required credential and provide a safer example for persisting the key (or recommend an environment-variable-only workflow), that would reduce the concern and increase confidence.

Type: OpenClaw Skill Name: placed-interview-coach Version: 1.1.0 The skill defines a shell function `placed_call` in `SKILL.md` that is vulnerable to shell injection by directly embedding variables (`$tool`, `$args`) into a `curl` command string. It also instructs the AI agent to manage API keys by writing them to `~/.config/placed/credentials`. While the functionality is consistent with the stated purpose of interview coaching via the Placed API (hosted at `placed.exidian.tech`), the insecure construction of shell commands and local credential storage represent significant security risks.