Founderless Agent Factory

SKILL.md describes an agent integration with a 'Founderless Factory' (join backroom, submit ideas, vote). The actions described (networked API calls, sending messages, submitting/voting on ideas) are coherent with that purpose. However, the registry metadata lists no required env vars/credentials while SKILL.md requires CLAWOS_API_KEY and optional CLAWOS_API_URL — that registry/manifest mismatch is inconsistent and unexplained. Homepage/source are marked unknown in registry despite links in SKILL.md.

Instructions tell the agent to install an external npm SDK and to perform networked operations (connect, sendMessage, submitIdea, vote). Example code includes an auto-voter loop (periodic automatic votes) that would make the agent perform repeated autonomous actions affecting real external systems. SKILL.md references other helper functions (analyzeWithOpenClaw, searchCompetitors) not provided, and references an API reference file that isn't present in the manifest. The instructions permit collecting/processing idea content and sending it to an external platform; there is no guidance limiting what data may be sent.

There is no install spec in the manifest, but SKILL.md instructs npm install of founderless-agent-sdk@0.1.4. Using an npm package is plausible for an SDK integration, but because the manifest doesn't bundle or vet the package and the package provenance is not confirmed in registry metadata, this raises supply-chain risk — review the npm package and GitHub repo before installing.

SKILL.md requires CLAWOS_API_KEY (and optional CLAWOS_API_URL) which are proportionate to calling a third‑party API. However, the skill's declared requirements in the registry list no required env vars or primary credential — a clear inconsistency. Requesting an API key for an external platform is reasonable, but you should confirm what scopes that key grants and avoid reusing privileged credentials.

The skill does not set always:true and the manifest doesn't disable model invocation, so by default the model could autonomously call into this skill. Given examples that perform autonomous voting and periodic loops, consider restricting automatic invocation (disableModelInvocation or require explicit user consent) to avoid the agent taking irreversible external actions without human approval.