SmartSaaS

Install via extraDirs (not clawhub). Never auto-add items: only add when user explicitly asks; user defines what to add. Scripts: create-dataset.sh, add-to-d...

What to consider before installing or enabling this skill: - Metadata mismatch: The skill manifest claims no required environment variables or binaries, but the scripts require SMARTSAAS_BASE_URL and SMARTSAAS_API_KEY and some scripts call python3. Do not rely on the registry metadata; treat SMARTSAAS_BASE_URL and SMARTSAAS_API_KEY as required and ensure python3 is present if you will resolve folders by name. - Credential scope and placement: The API key grants broad access to the backend (create datasets, list users, remove integrations, dispatch webhooks). Use a scoped/dedicated API key with least privilege, and set it in OpenClaw's skill env (skills.entries.smartsaas.env) rather than pasting it in chat. Confirm the key's permissions before use. - Inconsistencies to fix or review: add-to-dataset behavior in the code differs from SKILL.md (wrapper vs direct payload), and the script emits a curl example on error (contradicting 'do not show curl'). These inconsistencies can lead to wrong API payloads or accidental exposure of usage patterns. Review add-to-dataset.sh and the SKILL.md guidance and test the scripts in an isolated environment to confirm expected behavior. - Source verification: The skill's source is 'unknown' and homepage is missing. If you plan to run these scripts against production data, verify the author and repository integrity (or run in a sandbox first). Consider running it in a staging environment and auditing traffic to the SMARTSAAS_BASE_URL. - Runtime safety: Because the skill issues network requests to the configured base URL, run it only with a backend you trust. If you enable cron/dispatch scripts, be careful: configure webhook targets and schedules deliberately to avoid unexpected automated actions. If you want, I can list the exact lines in add-to-dataset.sh and SKILL.md that contradict each other, or produce a recommended corrected SKILL.md / metadata snippet that declares the required env vars and binaries.

Type: OpenClaw Skill Name: smartsaas-ai Version: 1.0.0 The skill bundle exhibits several high-risk behaviors and security vulnerabilities. Multiple scripts (e.g., add-to-dataset.sh, create-dataset.sh, and others) use 'curl -k', which disables SSL certificate verification, exposing the agent to man-in-the-middle attacks. The SKILL.md instructions explicitly command the AI to bypass the standard 'clawhub' installation process in favor of manual configuration via 'extraDirs', which can be used to evade security auditing. Additionally, the scripts use 'sed' for JSON construction, which is highly brittle and susceptible to injection vulnerabilities if user-provided data contains special characters.