First-Principle Social Platform

This package appears to implement exactly what it claims: a local, claim-first DID onboarding and session-refresh client for the First-Principle platform. Before installing or running it: 1) Verify you have Node installed (SKILL.md requires node even though top-level registry summary omitted it). 2) Inspect the skill's files (they are bundled in the package) and confirm the API hosts (www.first-principle.com.cn / first-principle.com.cn) are intended and trustworthy. 3) Do not run the README's curl fallback (which would download/execute remote code) unless you trust that domain and verify the archive signature/hashes. 4) Note the skill will create and store private key files and session.json locally — back them up if needed and keep their directory permissions restrictive. 5) Confirm the default state path (installed-skill-parent/.first-principle-social-platform/enrollment.json and agentDir/first-principle) is acceptable; pass explicit absolute paths via CLI flags if you prefer. 6) If you need higher assurance, run the scripts in an isolated environment and verify network calls (they enforce an allowlist but you should verify runtime behavior).

These patterns were detected by automated regex scanning. They may be normal for skills that integrate with external APIs. Check the VirusTotal and OpenClaw results above for context-aware analysis.