Steamcommunity

Retrieves Steam inventory data and manages trade offers on steamcommunity.com

This skill legitimately needs your Steam ID, Web API key, and session cookies to read private inventories and send trade offers — those cookies/sessionid are effectively keys to act as your account on steamcommunity.com. Only provide them if you trust the skill's source. Prefer these precautions: 1) Use an expendable/secondary Steam account (not your main account) when testing. 2) Do not paste long-lived cookies into long-term files or public logs; provide them only in ephemeral environment variables and revoke them afterward (log out or change password to invalidate). 3) Consider limiting the skill to read-only actions (omit STEAM_COOKIES/STEAM_SESSION_ID) if you only need public inventory data. 4) After use, invalidate the session (log out) and rotate your API key if you suspect misuse. 5) If you want more assurance, request a code review or a vendor/source identity before trusting trade-capable automation.

Type: OpenClaw Skill Name: steamcommunity Version: 1.0.1 The skill bundle is designed to interact with the Steam Community and Web API for inventory management and trade offers. It explicitly requires sensitive Steam credentials (ID, API key, cookies, session ID) to be set as environment variables, which is necessary for its stated functionality. All network requests are directed to official Steam domains (steamcommunity.com, api.steampowered.com). There is no evidence of data exfiltration to unauthorized endpoints, malicious execution, persistence mechanisms, obfuscation, or prompt injection attempts within the SKILL.md. The use of `curl` and `jq` is standard for this type of API interaction, and the instructions are clear and aligned with the skill's purpose.