Wafeq API Reference

Complete Wafeq accounting & e-invoicing API reference for the Middle East (UAE, Saudi Arabia). Use when building integrations with Wafeq, creating/managing i...

This appears to be a straightforward API reference that legitimately asks only for a Wafeq API key. Before installing/providing secrets: 1) Prefer creating a least-privileged or test API key (scoped or limited) rather than a full-production key. 2) If you must store the key in ~/.openclaw/openclaw.json, ensure that file is protected (filesystem permissions) and that you understand the persistence risk; consider using an OS secret manager instead. 3) Do not run scripts from unknown sources — SKILL.md refers to scripts/setup.sh but the package contains no scripts; if an install or README later asks you to run a downloaded script, review it first. 4) Because the agent can call the API autonomously, decide whether to allow autonomous use or to require user confirmation in your agent settings. 5) If you need higher assurance, verify the skill's provenance (who published it) or prefer installing an official integration from Wafeq or a trusted publisher. If any of these checks fail or you are unsure about the publisher, use a sandbox/test account/key first and rotate the key after testing.

Type: OpenClaw Skill Name: wafeq-api Version: 1.1.0 The skill bundle is benign, consisting solely of documentation files (`.md`) and metadata (`_meta.json`) for the Wafeq accounting and e-invoicing API. It describes legitimate API endpoints, schemas, and authentication methods (API key, OAuth2), emphasizing secure handling of API keys via environment variables or OpenClaw configuration. There is no executable code, obfuscation, or explicit prompt-injection attempts within the markdown to instruct an agent to perform malicious actions. The mention of `scripts/setup.sh` in `SKILL.md` is an instruction to the user, but the script itself is not included for analysis.