Stablecoin Use Check

A decision guide that helps users evaluate whether a stablecoin use case makes sense for them. Use when the user is considering holding or using a stablecoin...

This skill claims to be prompt-only but includes handler.py that reads a SKILL.md from a hardcoded directory (/Users/jianghaidong/.openclaw/skills/{skill_name}). That is inconsistent and could allow the skill to read files on the host. Before installing: (1) ask the author why handler.py must read local files and why a specific user path is hardcoded; (2) request removal of handler.py or that file reads be removed or sanitized (no absolute hardcoded home, no unsanitized skill_name); (3) if you must run it, do so in a sandboxed environment; (4) verify tests actually exercise file I/O — the provided test calls handle({}) but the handler will attempt to open a file, which is another inconsistency that should be resolved. If you don't trust the author or they cannot justify the file access, do not install.

Type: OpenClaw Skill Name: stablecoin-use-check Version: 1.0.0 The skill contains a hardcoded absolute file path in handler.py referencing a specific local user directory (/Users/jianghaidong/.openclaw/skills/), which leaks developer environment details and indicates poor security hygiene. While the SKILL.md content is a benign prompt-only guide for stablecoin evaluation, the handler logic is poorly constructed and potentially vulnerable to path traversal if the skill_name parameter is manipulated, even though no explicit exfiltration logic is present.