SimpleHttpSkill

Make HTTP requests (GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS) with custom headers, automatic retries, and graceful error handling. Use when the user need...

This skill appears to do exactly what it says: make HTTP requests using built-in Node modules with retries and graceful errors. Before installing, consider that the skill can send arbitrary requests to any URL you provide (including any headers you pass), so do not supply sensitive tokens or credentials unless you trust the agent and target endpoint. If you want to limit risk, run the skill in a restricted environment or network sandbox, and avoid embedding secrets in defaultHeaders; prefer passing credentials explicitly per-call and validate target URLs to avoid SSRF or unintended exfiltration.

Type: OpenClaw Skill Name: simplehttpskill Version: 0.1.0 The skill provides a robust HTTP client (`src/http-client.js`) capable of making arbitrary network requests (GET, POST, PUT, etc.) to any user-provided URL. While the implementation is clean, uses only built-in Node.js modules, and lacks direct evidence of malicious intent (e.g., no attempts to read sensitive files or environment variables, no obfuscation), the core capability of making unconstrained network requests is inherently high-risk. This could be leveraged for Server-Side Request Forgery (SSRF) or data exfiltration if the AI agent is prompted to target internal network resources or send sensitive data it has access to, classifying it as suspicious due to its powerful, potentially exploitable capabilities.