Share use case

Share your OpenClaw use case to clawusecase.com. Analyzes your recent work and creates a submission for the community.

This skill appears to implement the advertised feature (draft + submit use cases) but you should be cautious before installing: - Expect the assistant to read recent conversation history to draft the submission — that may disclose private messages you don't want published. - The OAuth flow uses a Convex endpoint (config.convexUrl). Verify you trust that host (benevolent-tortoise-657.convex.cloud) because it is queried with the OAuth token and returns the credential JSON. - get-credential.js prints the full credential JSON to stdout and poll-credential.sh echoes it. That JSON could include access tokens or other sensitive fields even if the README promises only public profile data. Ask the publisher to confirm or change the code to only return and expose public profile fields (username/display name) and to redact access/refresh tokens. - Consider requiring explicit user consent before submitting content publicly and avoid automatically including full credential blobs in submissions or logs. Recommended actions before enabling: 1) Inspect or run the code in a sandbox to confirm what fields the Convex backend returns (does it include access tokens?). 2) Replace or modify get-credential.js/poll-credential.sh so they only surface the minimal profile fields (username/platform) and do not print/store tokens. 3) Verify the identity/trustworthiness of the convex host or change to a backend under clawusecase.com if you control that service. 4) Ensure the assistant requests explicit user approval prior to sending any content to the public site and that anonymous submission is easy to choose. If you cannot confirm the above, treat the skill as potentially leaking sensitive OAuth data and avoid installing it in environments with sensitive conversations or credentials.

Type: OpenClaw Skill Name: share-usecase Version: 1.0.1 The skill is designed to share OpenClaw use cases, involving analysis of recent conversation history, OAuth for attribution, and submission to clawusecase.com. The primary concern lies in the `SKILL.md` file, which contains highly imperative instructions for the AI agent to execute shell commands (`node get-credential.js`) and actively monitor/parse their output in real-time. While the current scripts are benign and the parsing logic is specific to extracting OAuth credentials (username, platform), these strong prompt injection instructions for immediate command output processing represent a risky capability that could be exploited if the underlying scripts were compromised or designed to output arbitrary harmful instructions, even though no clear malicious intent is present in the current bundle.