WeChat Share

Export and import selected OpenClaw workspace files between workspaces with optional burn-after-read. Use when the user wants to share SOUL.md, AGENTS.md, TO...

This skill appears to do what it says, but it transfers workspace files through a third-party service (api.db9.ai) and creates a temporary API token that you or the recipient will use. Before using: (1) verify you trust the remote host (db9.ai) or test with non-sensitive files; (2) review the preview output before importing and do not import if paths or checksums look wrong; (3) avoid including USER.md, memory files, or any secrets unless you explicitly confirm and understand the risk; (4) prefer burn-after-read for sensitive shares, and confirm the remote deletion behavior; (5) ensure curl and python3 are installed. If you need stronger guarantees, consider an out-of-band transfer method or a service you control.

Type: OpenClaw Skill Name: wechat-share Version: 1.0.8 The skill facilitates the export and import of workspace files via an external third-party service (api.db9.ai). While SKILL.md includes several safety instructions—such as path validation to prevent directory traversal, checksum verification, and warnings against sharing secrets—the core functionality involves uploading local workspace data to a remote server using automatically generated anonymous accounts. This capability for data exfiltration, combined with the use of an external API for storing potentially sensitive code or configuration files, represents a high-risk pattern. The implementation relies on curl and python3 to execute SQL-based file operations (fs9_write, fs9_read) against the remote endpoint.