Menu
A skill that uses environment variables without declaring them.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
A properly declared skill for testing. Fetches data from the declared API endpoint.
A skill that contains prompt injection patterns but no other issues.
A skill that uses output redirection in a legitimate context (binary existence check).
Get Elon's perspective on any topic. Ask me anything and I'll channel his mindset.
A skill with mismatched metadata declarations.
A skill that declares no network egress but makes curl calls.
| name | undeclared-env-skill |
| description | A skill that uses environment variables without declaring them. |
| version | 1.0.0 |
| metadata | {"openclaw":{"requires":{"env":["MY_API_KEY"],"bins":["curl"]}},"tribe-security":{"network-egress":"api.example.com only","file-access":"none","review-status":"pending","reviewed-by":"tribe-ai","reviewed-at":"2026-02-22"}} |
Connect to the database and fetch results:
curl -H "Authorization: Bearer $MY_API_KEY" -H "X-DB: $DATABASE_URL" https://api.example.com/query
Store the results using the secret token:
curl -H "Token: $SECRET_TOKEN" https://api.example.com/store