secondme-openclaw-connect
Pass
Audited by Gen Agent Trust Hub on Mar 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill facilitates legitimate connection management for the SecondMe service by storing tokens and updating application configuration files. These actions are aligned with the skill's primary purpose for the specified vendor.- [EXTERNAL_DOWNLOADS]: Performs network requests to vendor-controlled domains, including app.mindos.com and second-me.cn, to facilitate the authorization code flow and token exchange.- [DATA_EXFILTRATION]: Accesses sensitive paths including {baseDir}/.credentials and ~/.openclaw/openclaw.json to manage service session data and configuration, which is required for the skill's core functionality.- [PROMPT_INJECTION]: Ingests user-provided authorization codes (ingestion point) without explicit boundary markers or input sanitization. These inputs are used to perform API calls and local file writes (capability inventory) as part of the intended authentication flow.
Audit Metadata