Solo Leveling — Life RPG

Solo Leveling — a life RPG skill that turns real-world habits into an addictive progression system. Inspired by the manhwa Solo Leveling, this skill features...

Before installing or enabling this skill, consider the following: - The skill's package contains working code to place phone calls via Twilio and generate TTS via ElevenLabs. To do that it expects Twilio credentials (account SID, auth token, from/to numbers) and an ElevenLabs API key — but the registry metadata claims no credentials are required. Ask the author to explicitly list required secrets and explain where they are stored. - The ElevenLabs/Twilio code will send data to external services and may upload audio to a public file host (transfer.sh) as a fallback. Audio and TTS text could include private content. If you use this, do not store API keys or personal phone numbers in plaintext files in shared locations. - SKILL.md suggests setting up cron jobs. Cron changes give the skill scheduled/persistent behavior. Only allow that if you understand and approve the exact cron entries; prefer manual scheduling or a sandboxed environment first. - Twilio calls can incur real charges and place calls to any configured 'target_number'. Verify the configured number(s) in twilio-config.json before running, and consider restricting network access or using test credentials. - The skill references Telegram-based verification in its rules but provides no Telegram integration code — ask for clarification on how verification is meant to work and whether any additional integrations are required. What would make this clearly safe: the author updates the registry metadata to list required credentials (Twilio & ElevenLabs), documents where credentials/config are stored and why, removes or documents the use of public upload fallback (transfer.sh), provides an option to disable external calls, and supplies explicit, reviewable cron setup commands. If you cannot get those clarifications, run the skill in a restricted sandbox, do not provide real API keys or phone numbers, or avoid installing it.

Type: OpenClaw Skill Name: solo-leveling Version: 1.0.0 The skill is classified as suspicious primarily due to the instruction in `SKILL.md` for the AI agent to 'Set up cron jobs based on config timezone'. This capability, if not handled with robust sanitization by the agent, presents a significant Remote Code Execution (RCE) vulnerability, allowing for arbitrary command execution and persistence on the host system. Additionally, the explicit instruction in `SKILL.md` to adopt a specific persona ('You ARE The System') demonstrates a clear use of prompt injection to alter the agent's behavior, a mechanism that could be exploited for malicious purposes in other contexts. The `scripts/elevenlabs_call.py` also uses `https://transfer.sh` for temporary public hosting of audio, which, while not malicious, introduces reliance on an external service and potential privacy considerations for the generated audio.