Setup Automatik

Facilitate the installation and management of VPS solutions using the Setup Automatik engine (powered by Orion Design). Use when the user wants to install, configure, or manage tools like Traefik, Portainer, Chatwoot, N8N, and other open-source applications on a Linux VPS.

This skill appears to be a legitimate VPS installer bundle, but treat it like running any third-party installer script: do not paste SSH private keys or root passwords into chat. Prefer the OpenClaw node-pairing flow (recommended) rather than sending credentials. Before running anything, manually review the full assets/SetupOrion.sh script (search for curl/wget/git/ssh/netcat, remote URLs, or commands creating users and SSH keys). If you must run it, (1) test on an isolated disposable VPS or VM, (2) create a temporary unprivileged user or restrict credentials (least privilege), (3) avoid sharing private keys in the chat — instead use a secure pairing or ephemeral credential, and (4) consider running the script interactively yourself after inspection rather than giving the agent autonomous access. If you want, provide the full SetupOrion.sh for a focused review of any network calls or potentially dangerous commands — that would raise or lower confidence in this assessment.

Type: OpenClaw Skill Name: setup-automatik Version: 1.0.0 The skill is classified as suspicious primarily due to the explicit instructions in `SKILL.md` for the agent to request and handle highly sensitive user credentials, specifically SSH private keys or root passwords for VPS access. While the stated purpose is legitimate VPS management, this method of acquiring and handling such critical credentials creates a severe security vulnerability and a significant attack surface. The absence of the `assets/SetupOrion.sh` script, which is described as the 'main installation script,' prevents a full assessment of the actual commands executed, but the credential handling alone is a high-risk design choice.