Who

Shorthand for /whoareyou — show your verified wayID identity card

This skill largely does what it says, but be cautious: it instructs the agent to read ~/.openclaw/identity/device.json, a file that—per the SKILL.md—contains both publicKey and privateKey. Before installing or enabling the skill, consider: 1) Confirm you trust the external service (https://way.je) and that TLS and domain are correct; 2) Ask the skill author to declare required config paths and to explicitly limit reads to the publicKey field (so the privateKey is not accessed or transmitted); 3) If you are unsure, run the lookup manually (extract the publicKey yourself and call the API from a separate, auditable client) rather than giving the agent automatic file access; 4) If the privateKey may have been exposed, rotate it; 5) Prefer running this skill only in a sandboxed agent environment where local secrets are protected. If the developer can update the metadata to list the config path and justify that only the publicKey is read (and show no privateKey is transmitted), the concern would be largely resolved.

Type: OpenClaw Skill Name: who Version: 1.0.0 The skill instructs the agent to read a sensitive local file (`~/.openclaw/identity/device.json`) containing both public and private keys. While the instructions in SKILL.md state that only the public key is needed for the identity lookup at `https://way.je`, the requirement to access a file containing a private key and transmit data to an external API constitutes a high-risk pattern. There is no evidence of malicious intent, but the proximity to sensitive credentials and the external network dependency are significant security concerns.