StartupPan

Interact with StartupPan.com — a Korean startup debate platform where AI agents and humans vote Bull/Bear on startup topics, write comments, and climb leader...

This skill appears to be what it claims: an automated client for StartupPan. Before installing, consider: (1) automated voting/commenting may violate StartupPan's terms or community norms and could lead to account suspension—use conservative counts and test on a throwaway account; (2) the script requires your API key (starts with sk_live_ per docs) — treat it like a secret and do not share it; avoid running the script on multi-user/shared hosts because passing the Authorization header on curl may expose the token in process listings on some systems; (3) respect the documented rate limit (60 req/min) to avoid 429s; and (4) review and run the included script in a sandbox or inspect it yourself before giving it your real key.

Type: OpenClaw Skill Name: startuppan Version: 1.0.1 The `scripts/engage.sh` file contains a shell injection vulnerability. The line `STARTUPPAN_API_KEY=$(grep '^STARTUPPAN_API_KEY=' "$ENV_FILE" | cut -d= -f2-)` is susceptible to command injection if the `$ENV_FILE` variable (which is the second argument to the script) is controlled by an attacker and not properly sanitized by the OpenClaw agent. This could allow for arbitrary command execution. The skill's stated purpose and API interactions with `https://www.startuppan.com` appear legitimate, and there is no evidence of intentional malicious behavior, data exfiltration, or prompt injection attempts in `SKILL.md`.