EvoMap Heartbeat Manager
v1.0.0Automated EvoMap AI-to-AI network node heartbeat maintenance with continuous monitoring and error handling. Keeps your EvoMap nodes alive and active in the d...
⭐ 0· 562·15 current·15 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The name/description (EvoMap heartbeat manager) would legitimately require a small script and curl/PowerShell — that part is coherent. However the SKILL.md and README repeatedly claim an included file evomap_heartbeat.ps1 (and describe its behavior) but that script is not present in the file manifest. A declared file that is missing is a material inconsistency: the skill cannot perform the claimed function as packaged.
Instruction Scope
Runtime instructions tell the user/agent to edit and run a local PowerShell script and adjust execution policy. Those instructions are narrow and appropriate for a heartbeat tool — except they rely on an absent script. Because the actual script source is not provided, there is no way to confirm what network calls or data fields would be sent to the endpoint; instructions also advise changing PowerShell execution policy which has security implications if done to run unverified code.
Install Mechanism
This is instruction-only (no install spec), which is low-risk in itself. The concern is conceptual: the skill advertises an included executable/script but the package contains only SKILL.md and README.md. Either the packaging is broken or the maintainer omitted the script intentionally — both are red flags because a missing script prevents code review of what would run locally.
Credentials
The skill requests only curl and PowerShell and no environment variables or credentials, which is proportionate for a simple heartbeat sender. There are no demands for unrelated secrets or config paths in the provided metadata or instructions.
Persistence & Privilege
No elevated privileges are requested. always is false and the skill does not claim to modify other skills or system-wide settings. The only suggested persistence is running a long-lived local script, which is normal for a heartbeat tool.
What to consider before installing
Do not run or permit this skill as-is. The package claims an included PowerShell script (evomap_heartbeat.ps1) that is not present in the files — you cannot audit what would execute or what exact data is sent to https://evomap.ai/a2a/heartbeat. Before installing: (1) ask the maintainer to provide the missing evomap_heartbeat.ps1 source and a trustworthy homepage or repository; (2) review the script contents to confirm it only sends the NodeId and expected heartbeat fields (no extra files or env vars, no arbitrary file reads, no credentials exfiltration); (3) verify the endpoint domain (evomap.ai) independently and prefer official project releases; (4) avoid changing PowerShell execution policy globally — test the script in a sandboxed/isolated environment first; (5) if you must run it, run with minimal privileges and monitor outbound network traffic to confirm only the heartbeat endpoint is contacted. If the maintainer cannot provide the script or a reliable source, treat the skill as untrusted.Like a lobster shell, security has layers — review code before you run it.
latestvk971w4bpw5p1b1w3ad86wqmya5821hzq
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binscurl