WonderDash

Create and manage widgets on the user's WonderDash mobile dashboard via GitHub

This skill's behavior (reading/writing widgets in a GitHub repo via SSH) is consistent with its description, but it requires you to supply and save an SSH private key — something the registry metadata does not declare. Before installing or using it: 1) Verify the publisher and the repository URL out-of-band; do not paste a reusable personal SSH key. 2) Prefer a dedicated, least-privilege credential: a repo-scoped deploy key or a machine account with only the minimum permissions needed (ideally read-only if you only need to pull, or a tightly-scoped write key only for this repo). 3) Audit widget HTML before committing (webview widgets can include JavaScript that may run in the app). 4) Avoid reusing the key elsewhere and rotate/delete the key when no longer needed. 5) If possible, prefer a workflow where changes go through pull requests and human review instead of allowing direct pushes by an automated agent. Finally, ask the skill publisher why the registry metadata omits the credential requirement — that inconsistency should be resolved.

Type: OpenClaw Skill Name: wonderdash Version: 1.0.0 The skill instructs the AI agent to perform high-risk operations, specifically writing an SSH private key to `~/.ssh/wonderdash_deploy` and modifying the user's `~/.ssh/config` file to facilitate GitHub access. While these actions are consistent with the stated goal of managing a dashboard via a Git repository, handling raw private keys and altering SSH configurations are high-privilege tasks that could be exploited for unauthorized access or persistence if the agent is provided with malicious setup data.