Yield Offer Sanity Check

A checklist skill that evaluates whether a yield, staking, or earn offer is reasonable or suspicious. Use when the user encounters a yield promotion. Prompt-...

The skill's markdown describes a prompt-only checklist, but the included handler.py reads a hard-coded absolute path (/Users/jianghaidong/.openclaw/skills/{skill_name}/SKILL.md). This is inconsistent and risky: if the platform executes handler.handle with a crafted skill_name, the code could read local files (and path traversal via '..' segments may be possible). Before installing, ask the author why the skill needs to read a local SKILL.md and request that they remove filesystem access or sanitize and constrain paths. If you must test it, run the skill in a tightly sandboxed environment, inspect/modify handler.py to remove the file read, or demand the skill be truly prompt-only (no code). Also consider denying autonomous invocation or reviewing runtime logs for unexpected file reads. Do not install it into a production agent until the file-access behavior is explained or removed.

Type: OpenClaw Skill Name: yield-offer-sanity-check Version: 1.0.0 The skill contains a significant security flaw in handler.py, where it uses a hardcoded absolute path to a specific user's home directory (/Users/jianghaidong/.openclaw/skills/) and lacks sanitization for the skill_name parameter. This creates a potential path traversal vulnerability if the skill_name is user-controlled. While there is no evidence of intentional data exfiltration or malicious logic, the inclusion of environment-specific paths and insecure file access patterns is highly irregular for a portable skill bundle.