Backup image to StarDots

Automatically back up images to stardots.io cloud storage with secure MD5 authentication and configurable credentials.

Before installing: 1) Verify you trust the publisher (source/homepage are not provided here). 2) Only provide Stardots API credentials you intend to use for image backups (use scoped or revocable keys if possible). 3) Be aware the skill reads ~/.config/stardots/config.json and environment variables; don't place unrelated secrets there. 4) Confirm that attachment paths are controlled by the platform and cannot be crafted to point to sensitive local files (otherwise the skill could upload local files labeled as images). 5) Review the endpoint (https://api.stardots.io) and the support contact in skill.yaml if you need provenance. 6) If you have strict security requirements, review the code locally or run in a sandboxed environment before granting network/filesystem permissions.

Type: OpenClaw Skill Name: stardots-backup Version: 1.0.0 The skill is designed to upload images to stardots.io but contains a potential shell injection vulnerability in `src/index.ts` (and `dist/index.js`). It constructs a `curl` command using `tools.exec` by directly embedding configuration values such as `apiKey` and `space` into the command string without sanitization. While the code's behavior aligns with its stated purpose and no clear evidence of intentional malice was found, the use of unsanitized inputs in a shell execution context is a high-risk vulnerability.