Whirlwind

Production-ready Next.js AI SaaS template with Supabase auth, Stripe payments, email system, multi-model AI client, and customizable components for rapid AI...

This skill appears to be a legitimate template generator, but exercise caution before providing secrets. Do not paste high-privilege keys (especially SUPABASE_SERVICE_ROLE_KEY, Stripe secret keys, or any private AI provider keys) directly into chat. Prefer the following safer workflow: - Verify the skill's source (GitHub repo, package publisher) and review the templates locally before running any automated setup. The registry metadata lacks a verified homepage — confirm the repository URL is legitimate. - When setting up services, create and paste only low-privilege keys into client-side config (e.g., public anon keys or publishable Stripe keys). Never disclose service_role or secret API keys in a conversational interface. Use your hosting platform's secrets manager or environment configuration (Vercel, Supabase project settings, etc.). - Inspect the generated .env files and ensure server-only secrets are kept out of client builds. SUPABASE_SERVICE_ROLE_KEY must only be used server-side and not committed to version control or exposed to the browser. - If you want ClawdBot to help with setup, restrict it to providing commands and checklists rather than collecting secrets. If you must provide keys to the skill, do so via a secure channel (not chat) and consider creating limited-scope API keys for this purpose. - If you plan to run the setup automatically, review the code paths that persist secrets and run migrations locally or in an isolated environment first. Given the mismatch between the manifest and the instructions and the explicit instruction to collect secrets in chat, treat this skill as suspicious until you confirm its provenance and adjust how secrets are supplied.

Type: OpenClaw Skill Name: whirlwind Version: 1.0.0 The Whirlwind skill bundle functions as a comprehensive setup assistant for a SaaS template, but it is classified as suspicious due to its aggressive collection of high-privilege credentials. The 'SETUP_WORKFLOW.md' and 'SKILL.md' files instruct the agent to solicit extremely sensitive secrets from the user, including the Supabase Service Role key (which bypasses Row Level Security), Stripe Secret keys, and multiple AI API keys. While the instructions direct the agent to save these to a local '.env.local' file, the process involves handling these secrets within the agent's context, creating a high risk of accidental exposure or misuse. Furthermore, the skill relies on cloning an external repository (github.com/WhirlwindAI/whirlwind), which introduces a supply chain risk as the core logic resides outside the analyzed bundle.