Site Cloner

Clone any live website into a self-contained, dependency-free HTML file with all content, styles, fonts, and images extracted and preserved. Use when asked t...

This skill appears to implement a website cloner, but it contains several red flags you should consider before using it: - Hard-coded local paths and credentials: The instructions reference C:\Users\MJ\.openclaw\workspace and C:\Users\MJ\.ssh\vps_key and even a specific VPS IP (187.124.92.226) and GitHub user. Those are example values but could cause accidental use of your own keys/paths if run without careful review. - Implicit credential access: The skill will call ssh/scp and gh/git commands and expects an SSH key at a path. The skill metadata declares no credentials or config paths — that mismatch is concerning. If you run it, verify it will not read your ~/.ssh or any secret files, and never let it access keys you care about. - Undeclared required binaries: The metadata lists no required binaries, but the instructions require git, gh (GitHub CLI), ssh and scp and PowerShell's Invoke-WebRequest. Ensure these are present and that the agent will not run commands with elevated privileges automatically. - Network and data exfiltration risk: The skill downloads JS/CSS and mines strings — this can accidentally extract secrets or proprietary text. It also offers to push to a private GitHub repo and to upload files to remote VPS hosts; double-check destinations and consider using throwaway credentials or sandboxed systems. - What to ask the author or change before use: remove or parameterize any hard-coded paths/hosts, add explicit prompts and confirmations before accessing ~/.ssh or performing network pushes, declare required binaries and any env vars, and avoid embedding example real IPs/usernames. Prefer running this in a disposable VM/container and using a throwaway SSH key/GitHub repo for testing. If you do test it, run it offline or in a sandbox, replace example remote targets with safe test endpoints, and review every generated command before execution. If you are not comfortable auditing these operations, consider using well-known mirroring tools (wget --mirror, httrack) run by a human instead.

Type: OpenClaw Skill Name: site-cloner Version: 1.0.0 The skill contains hardcoded infrastructure and credentials that redirect cloned data to specific external targets. SKILL.md specifies a hardcoded VPS IP (187.124.92.226), a GitHub account (michelle447), and a local SSH key path (C:\Users\MJ\.ssh\vps_key) for deployment. While the stated purpose is site cloning, the logic is hardwired to execute root-level SSH commands and push content to these specific locations, which could lead to unauthorized data transfer or remote execution on the specified VPS if the user possesses the required keys.