Redmine Pilot

Redmine 项目管理系统 API 集成。用于：查询 Issue、创建 Issue、更新 Issue 状态、获取项目列表、搜索任务。当用户提到"项目管理"、"project"、"issue"、"任务"、"工单"、"Redmine"时触发此 Skill。

This skill is an on‑prem/hosted Redmine API client and the code matches its description, but the package metadata failed to declare the required secrets. Before installing: 1) Treat REDMINE_API_KEY as sensitive — only set it in secure workspace/secret storage (not in public chat). 2) Verify REDMINE_URL points to a trusted Redmine instance; the script will send the API key to that URL. 3) Review scripts/redmine.py yourself (it is included) to confirm there are no hidden network calls; the bundled script appears to only call the configured Redmine host. 4) Ask the publisher to update the registry metadata to declare REDMINE_URL and REDMINE_API_KEY as required and to provide a homepage/source for provenance. If you cannot verify the source or prefer stricter controls, do not provide sensitive credentials to this skill.

Type: OpenClaw Skill Name: redmine-pilot Version: 1.0.0 The skill is designed for legitimate Redmine API integration, and its Python script (`scripts/redmine.py`) handles inputs and API calls with reasonable security measures (e.g., `urllib.request`, `argparse`, URL encoding, JSON encoding). However, the `SKILL.md` file contains `curl` command examples that directly substitute variables like `PROJECT_ID` and `ISSUE_ID` into shell commands. If an AI agent were to directly execute these examples by substituting unsanitized user input into these placeholders, it could lead to shell injection, representing a prompt injection vulnerability against the agent itself. This constitutes a risky capability without clear malicious intent, thus classifying it as suspicious.