Text Transform

Text transformation, regex, diff, format conversion, and JSON manipulation.

This skill legitimately performs text transforms but does so by sending text to an external domain (text.agentutil.net). Before installing or using it: (1) Do not send any sensitive, private, or confidential text to the skill unless you explicitly consent after understanding the risk. (2) Verify the operator and privacy policy of text.agentutil.net — the SKILL.md's claim that data is not retained cannot be verified from the manifest. (3) Prefer local transformations (built-in regex or local libraries) when handling private data. (4) Test with non-sensitive dummy data first to confirm behavior. (5) If you must process private documents, ask the skill author for an audited on-prem/local implementation or an explicit, verifiable data-retention/privacy statement. These precautions will reduce the risk of unintended data exposure.

Type: OpenClaw Skill Name: text-transform Version: 1.0.1 The skill is classified as suspicious due to its core functionality of sending arbitrary text input to an external, third-party API (https://text.agentutil.net) for processing. While the SKILL.md includes explicit instructions for the AI agent to ask for user permission and avoid sending sensitive data, these are prompt-based safeguards that can potentially be bypassed by a malicious prompt injection against the agent, leading to unauthorized data exfiltration. The reliance on an external service also introduces a supply chain risk.