ssy-batchjob-async-job

Use BatchJob HTTP APIs for strict upload validation, precheck, submit, polling, and cancellation. Full-auto file source resolution (file_id/local path/public...

This skill appears to be what it says: a BatchJob upload and job-management helper that uses your BATCHJOB_BASE_URL and BATCHJOB_BEARER_TOKEN. Before installing, consider: (1) the skill is designed to run in 'full-auto' resolution mode and may automatically read and upload files it finds in the message/runtime context (local paths like /tmp/..., attachments, or workspace template files). Make sure you trust the agent and the BatchJob endpoint and that you do not have sensitive files accessible in those locations; (2) restrict the BATCHJOB_BEARER_TOKEN scope if possible and use a dedicated account for uploads to limit blast radius; (3) verify channel adapters and runtime permissions — if the runtime can download attachments, the skill will use that capability; (4) if you prefer explicit confirmation before uploads, ask the skill author to expose a conservative mode requiring user confirmation. If you need higher assurance, request the full origin/homepage or source code before deployment.

Type: OpenClaw Skill Name: ssy-batchjob-async-job Version: 0.0.1 The skill implements a 'full-auto' file upload and job management workflow in `SKILL.md` that reads local files, base64 encodes them, and transmits them to a remote API defined by environment variables. While aligned with its stated purpose of managing batch jobs, the capability to read arbitrary local paths and download from public URLs via `curl` without strict path sanitization or human-in-the-loop confirmation presents a high risk for data exfiltration or local file inclusion (LFI) if the agent is misdirected by a user. No clear evidence of intentional malice or hardcoded malicious endpoints was found.