Secure Communicator

Secure communication using the Pieter Theijssen triple-layer XOR encryption algorithm. Use when encrypting or decrypting messages, files, or any sensitive da...

This skill is a local Node.js script that implements a custom triple-XOR cipher. Before installing or using it: - Do not treat this as strong cryptography. XOR-based schemes are weak compared to standard primitives (AES-GCM, ChaCha20-Poly1305). The SKILL.md even warns it is not a substitute for professional crypto. Avoid using it for high-value secrets. - The package metadata lists 'openssl' as a required binary but the code never calls openssl — this is unnecessary and unexplained. Ask the author why openssl is required or remove that dependency. - The code has bugs: splitKey can produce an empty third key when key length is divisible by 3, which will cause a crash (modulo by zero). Test thoroughly and prefer a patched implementation before trusting it. - The script prints decrypted metadata to stderr, which can leak filenames and mime types; if that is sensitive, modify the script to avoid printing metadata or ensure stderr is not exposed. - There's leftover/simplified code paths and unused functions in the file (unused encrypt() earlier), suggesting the implementation is unfinished. Prefer a maintained, audited library or a minimal, clearly implemented tool. If you decide to proceed: run the tool only on non-sensitive test data first, review and fix the key-splitting bug, remove the spurious 'openssl' requirement, and consider migrating to well-reviewed cryptographic libraries for real secrecy needs.

Type: OpenClaw Skill Name: secure-communicator Version: 1.0.1 The skill implements a custom 'Triple-layer XOR' encryption algorithm which is cryptographically weak and contains a logic error in the splitKey function within scripts/theijssen-cipher.js (the third key part is incorrectly sliced as key.slice(partSize * 3), resulting in an empty buffer). While there is no evidence of intentional malice, data exfiltration, or backdoors, the use of non-standard, flawed cryptography for 'sensitive data' is a significant security vulnerability. The implementation also includes unused or partially implemented stubs for encryption/decryption that do not match the primary CLI logic.