Quote/0

Control MindReset Dot Quote/0 through the local quote0.js script and Dot Developer Platform APIs. Use when the user asks to configure Quote/0, push text/imag...

This skill appears internally consistent and implements exactly what it claims: a Node CLI that calls the Dot Open API using your DOT_API_KEY and DOT_DEVICE_ID. Before installing/using it: - Only provide the API key and device id you intend to use. Prefer the single-command (--apiKey) or temporary env methods the SKILL.md recommends rather than persisting keys in shell rc files. - Do not pass sensitive local file paths to --imageFile; the script will read and upload whatever path you supply. Avoid pointing it at private keys, configuration files, or other secrets. - The CLI communicates over HTTPS to https://dot.mindreset.tech; trustworthiness of that service is outside this review. If you don't trust the service, do not supply real credentials. - If you want extra caution, review quote0.js locally (it is short and readable) before running. You can also create an API key with limited scope or revoke it later if needed. Confidence in this assessment is high because the source code and instructions are present, readable, and align with the declared purpose.

Type: OpenClaw Skill Name: quote0 Version: 1.0.4 The skill is designed to interact with a specific API, and the `quote0.js` script primarily performs its stated function. However, the `image` command in `quote0.js` allows reading any local file specified by `--imageFile` and uploading its base64 content to the remote API. While the script includes strict validation to ensure the file is a PNG (checking both extension and magic bytes), this still represents a risky capability. An AI agent could potentially be prompted to upload a sensitive PNG file (e.g., a screenshot containing confidential information) from an arbitrary location on the filesystem. The `SKILL.md` file explicitly warns against passing sensitive file paths to `--imageFile`, acknowledging this potential risk, which contributes to the 'suspicious' classification rather than 'benign' due to the inherent data leakage risk if misused.