GigaChat (Sber AI) Proxy

Integrate GigaChat (Sber AI) with OpenClaw via gpt2giga proxy

This skill appears to do what it claims, but before installing: (1) review the gpt2giga package on PyPI/GitHub to ensure you trust it (pip install will run third‑party code); (2) store your CLIENT_ID/CLIENT_SECRET carefully (the skill uses a base64-encoded GIGACHAT_CREDENTIALS in a file—use chmod 600 and keep it in your home directory); (3) check ~/.openclaw/gpt2giga.log after startup for any sensitive output (tokens might appear in logs depending on upstream library behavior); (4) back up your openclaw.json before running the patch script (the script does create a .bak but verify contents); (5) consider running the proxy on an isolated user account or container if you want extra separation; and (6) install the Sber root CA to enable SSL verification as suggested to avoid running with TLS verification disabled.

Type: OpenClaw Skill Name: sber-gigachat Version: 1.1.2 The skill bundle contains functional scripts for GigaChat integration but includes high-risk security practices and vulnerabilities. Specifically, `scripts/start-proxy.sh` and `scripts/start.sh` explicitly disable SSL certificate verification by default if the Sber CA is not found, which exposes the connection to Man-in-the-Middle (MITM) attacks. Additionally, `scripts/patch-config.sh` is vulnerable to Python code injection because it unsafely interpolates the `$CONFIG` environment variable directly into a `python3 -c` command string. While these appear to be functional workarounds or unintentional flaws, they constitute significant security risks.