SSL Certificate Manager

Automate SSL certificate generation and management with DNS challenge validation and certificate provisioning.

This skill appears to describe a certificate-management API but omits critical operational details. Before installing or using it: 1) Ask the publisher for the API base URL and authentication method — do not assume requests are to a trusted host. 2) Confirm how private keys are handled: never fetch or store private.key into shared agent logs or third-party endpoints; require secure, private storage and transport (HTTPS, access controls). 3) Verify the provider's identity and reputation (homepage, documentation, TLS certs for the API host). 4) Prefer skills that explicitly declare required credentials (API key or OAuth) and include a servers field in openapi.json. 5) If uncertain, avoid using the download endpoint through the agent; manage private keys via your own infrastructure or vetted tooling. These gaps could be benign (incomplete docs or a local-only stub) but also could mask misuse — proceed only after clarifying the missing pieces.

Type: OpenClaw Skill Name: ssl-certificate-manager Version: 1.0.0 The skill facilitates SSL certificate management via the api.mkkpro.com service but is classified as suspicious due to high-risk security practices. Specifically, the service generates and stores private keys on its own servers rather than using local CSR generation, allowing them to be retrieved via the /download/{cert_name}/private.key endpoint as documented in SKILL.md and openapi.json. This architectural vulnerability exposes sensitive credentials to a third party, which is a significant security risk, although the behavior appears aligned with the tool's stated purpose and lacks clear evidence of intentional malice.