openclaw-studio-dashboard

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes examples that print and embed tokens verbatim (e.g., echoing STUDIO_ACCESS_TOKEN, using ?access_token=... in curl/URLs and echoing "Access token: $STUDIO_ACCESS_TOKEN"), which require handling/outputting secret values directly and are high-risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's install/startup instructions run remote code (e.g., "npx -y openclaw-studio@latest" and the git clone at https://github.com/grp06/openclaw-studio.git), which fetches and executes external package/source as part of running the studio, so external content is executed at runtime.