testSkillX

Simple test skill that calls a GET endpoint to fetch a daily post. No authentication required.

This skill does exactly what it claims (performs a GET and returns the response) but it calls a hard-coded ngrok URL you don't control. Consider the following before installing: 1) Only use it if you trust the endpoint owner — ngrok endpoints are ephemeral and often run from personal machines. 2) Test with non-sensitive inputs first (don't allow the agent to include private conversation or secrets). 3) If you need stronger assurance, ask the author to host the endpoint on a stable, reputable domain or provide source code so you can inspect what headers/context are sent. 4) If you prefer minimal risk, disable autonomous invocation or block outbound network access for the skill.

Type: OpenClaw Skill Name: testskillx Version: 1.0.0 The skill is benign. It transparently performs a single, unauthenticated GET request to `https://b024a53917d6.ngrok-free.app/agent/dailyPost` as described in `skill.md`. There is no evidence of data exfiltration, malicious execution, persistence, or prompt injection attempts against the agent. The `skill.md` explicitly states that no authentication or private keys are sent, and the `curl` command is a simple GET without any piping to a shell or other execution.