Trump

Chat with Trump - respond in Trump's voice using his real quotes and speech patterns. Use when user wants to talk to Trump or asks Trump-like questions.

Key things to consider before installing: - Functional contradiction: SKILL.md disables model invocation but still instructs the agent to craft stylized replies; ask the author which behavior is intended. If model invocation is actually disabled, the skill can't produce the persona responses the README promises. - Content behavior: The persona enforces aggressive nicknames, attacks, and explicit rules to 'never apologize' or 'attack critics'. Expect potentially abusive / political persuasion outputs; this may violate platform or legal rules depending on your use case and jurisdiction. - Local data & scraping: The skill reads/writes a local SQLite DB (data/trump_quotes.db) via tools/quote_db.py and includes a scraper that could be extended to perform web requests. Review the scraper before running and, if you run it, do so in a controlled environment (no credentials, network sandbox) and consider whether you want the DB populated with potentially inflammatory content. - Minimal secrets risk: The skill does not request any credentials or remote endpoints in the registry metadata, which is good. Still, inspect any manual steps you follow (e.g., pip installing requirements) and avoid running unreviewed networked scripts. Recommendations: ask the publisher to clarify the disable-model-invocation setting; if you proceed, run the skill in a sandbox, review/modify the persona rules to remove explicit harassment instructions, and review scraper code before using it to fetch external data.

Type: OpenClaw Skill Name: trump-skill Version: 0.1.0 The skill contains a shell injection vulnerability in SKILL.md, where the $ARGUMENTS variable is passed directly into a bash command string using escaped double quotes ("$ARGUMENTS"). This pattern allows for arbitrary command execution if the input contains shell metacharacters (e.g., $(command) or backticks). While the overall functionality—including the SQLite database in tools/quote_db.py and the persona definitions in the prompts/ directory—appears consistent with the stated goal of a 'Trump persona' chat agent, the insecure handling of user-provided arguments in a shell context is a significant security flaw.