SubsTracker

Manage SubsTracker subscriptions and configuration via CLI scripts. Handles login, subscription CRUD, config updates, notifications, and dashboard queries. U...

This skill appears to be a legitimate CLI wrapper for a SubsTracker REST API, but exercise caution before enabling it: - The skill requires SUBSTRACKER_URL, SUBSTRACKER_USER, and SUBSTRACKER_PASS at runtime, but the registry metadata doesn’t declare those — confirm you are comfortable providing those credentials and that the registry omission is acceptable. - It will read .env files from the current working directory and from your home directory and will write a cookie file to ~/.substracker-skills/cookie. Ensure those locations don’t unintentionally contain other secrets and that storing a session cookie on disk is acceptable. - The tool will send credentials and can update sensitive config fields (admin password, webhook URLs, notification tokens). Only point it at a SubsTracker server you trust (check the SUBSTRACKER_URL). - The SKILL.md suggests invoking this skill on any user mention of subscriptions (a very broad trigger). If you want to avoid accidental use, restrict invocation or require explicit user confirmation before running commands that access credentials or change config. - Because the source/homepage are unknown, prefer to: (a) request the upstream repository or signed publisher info, (b) review the files yourself (they are included), or (c) run the scripts in an isolated environment/container before giving it real credentials. If you trust the SubsTracker instance and accept the local file writes, the code appears coherent with its stated purpose; otherwise, treat it as suspicious until metadata (required envs, source) and invocation behavior are clarified.

Type: OpenClaw Skill Name: substracker Version: 1.1.0 The SubsTracker skill bundle is a legitimate CLI-based management tool for a SubsTracker instance, handling subscription CRUD, payment history, and system configuration. It manages sensitive data such as API tokens for notification services (Telegram, Bark, etc.) and administrative credentials, but this behavior is strictly aligned with its stated purpose. The code (scripts/client.ts, scripts/main.ts) uses standard environment variable loading and cookie-based authentication without evidence of data exfiltration, malicious execution, or prompt injection.