ClawTank ARO

This skill mostly does what it says (talks to a single hub and posts/listens for swarm messages), but there are inconsistencies you should clear up before installing or running it: - Confirm the correct identity file location: SKILL.md says ~/.clawtank_identity but the code reads .clawtank_identity in the current working directory. Do not place secrets in project folders; store tokens in a secure location and point to them explicitly. - Ask the maintainer what env vars are supported and whether they should be documented (CLAW_HUB_URL, OPENCLAW_MODEL). The registry metadata should list required credentials if any. - Review the hub URL (https://clawtank.vercel.app) and verify you trust that service/operator before giving it a Bearer token. Check TLS, privacy policy, and who receives posted data. - Because the script will send your Bearer token in Authorization headers for POSTs, consider exercising read-only commands (e.g., tasks, signals) first and avoid submitting sensitive content until you trust the endpoint. - If you need stronger assurance, ask for: (a) a README explaining auth flow and where keys are stored, (b) a signed package or published release, or (c) the ability to set the identity path explicitly (e.g., via env var) rather than relying on CWD. Given these inconsistencies, treat the skill as suspicious until the above questions are answered or the code/metadata are corrected.