SupaSkills

Search and load 1,000+ quality-scored expert skills from SupaSkills.ai

This skill appears to do what it says (search and load SupaSkills prompts) and uses only the SupaSkills API. However, the SKILL.md requires SUPASKILLS_API_KEY while the registry metadata does not declare it — ask the publisher to fix the metadata. Before installing: verify the supaskills.ai domain and publisher (homepage/repo), only supply an API key you control and can revoke, store it in a secrets manager (not checked into git), and consider disabling autonomous invocation for this skill if you don't want the agent to call the third-party API without explicit approval. If you need higher assurance, request the skill's source or API docs and confirm the key's scope and rate limits.

Type: OpenClaw Skill Name: supaskills Version: 1.1.0 The `SKILL.md` file defines `curl` commands that incorporate user-controlled parameters (`{query}` and `{slug}`) directly into shell commands. If the OpenClaw agent executes these commands without proper input sanitization, it introduces a significant shell injection vulnerability (potential RCE). While the skill's stated purpose is to interact with `supaskills.ai` and there is no clear evidence of intentional malicious behavior like data exfiltration to unrelated domains or persistence mechanisms, this critical vulnerability warrants a 'suspicious' classification.