SnapPwd Secure Secret Sharing

Securely share secrets, API keys, files, and credentials with OpenClaw agents and team members via self-destructing links. Use when the user needs to share s...

This skill appears to do what it says (create one-time encrypted links) and does not request unrelated credentials. Before using it: 1) Be cautious about what you share — avoid sharing long-term private keys or production secrets when possible; prefer generating temporary credentials or sharing only the minimal secret required. 2) If you must share private keys, rotate/revoke them immediately after use. 3) Verify the CLI package/source (github repo) before running npm install -g; installing global npm packages can be risky if the package is untrusted. 4) Confirm you are on the correct domain (https://snappwd.io) to avoid phishing, or consider self-hosting and pointing SNAPPWD_API_URL to your instance for sensitive uses. 5) Remember the URL fragment (the key after #) only lives in the client — do not paste the full URL into insecure logs; share the link only with verified recipients. If you want greater assurance about the implementation, ask the publisher for the CLI/service source repo and audit the npm package and server code before use.

Type: OpenClaw Skill Name: snappwd-share Version: 1.0.1 The skill facilitates the sharing of highly sensitive information by providing instructions and scripts to upload files like private SSH keys (~/.ssh/id_rsa) and environment configurations (.env) to an external service (snappwd.io). While the documentation (security-model.md) describes a zero-knowledge encryption architecture, the explicit targeting of high-value system credentials in SKILL.md and cli-usage.md creates a high-risk path for data exfiltration. The bundle encourages the AI agent to handle and transmit secrets that should typically remain local, which could be exploited via prompt injection.