Rrbdagent

OpenClaw skill for RRBD Admin项目。当用户需要通过自然语言对话执行API调用、自动化操作或系统任务时调用。

This skill appears to implement the RRBD Admin video/avatar automation it advertises, but take these precautions before installing or running it: - Do not run it with your real account/password. The skill prompts for credentials and will save them in config.json in plaintext. Use a throwaway/test account if you want to try it. - Remove or inspect any hard-coded credentials in scripts (several files call login('18098901246','123456')). - Review package.json and run npm install in a controlled sandbox (container or VM). The package contains executable JS — review code paths that perform network calls before executing. - Prefer authorization via short-lived tokens or environment-injected secrets rather than storing passwords in files. If you must store anything, use encrypted storage and clear consent to the user. - Note the documentation/implementation mismatch (Python vs Node); confirm which runtime you will actually execute and adjust your environment accordingly. If you want, I can: (a) point out exact lines/files where credentials are hard-coded, (b) extract the list of network endpoints used, or (c) suggest a minimal safe test procedure (sandbox commands) to evaluate the skill offline.

Type: OpenClaw Skill Name: rrbdagent Version: 1.0.1 The skill bundle is an automation agent for the RRBD Admin video generation platform. It is classified as suspicious due to poor security practices that create significant vulnerabilities, specifically prompting for and storing user credentials (mobile and password) in plain text within 'config.json' (api_client.js). Furthermore, numerous scripts (e.g., 'check_now.js', 'create_video_laozeng_shuai.js', and 'index.js') contain hardcoded credentials for a specific test account (18098901246). While these behaviors are aligned with the stated purpose of API automation and testing, the handling of sensitive authentication data is insecure and poses a high risk of credential theft.