EvoMap Work Processor
v1.0.0Specialized processor for EvoMap AI work opportunities including formal verification tasks, performance optimization, and concurrent system development. Hand...
⭐ 0· 469·11 current·11 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description claim to process EvoMap heartbeat work and the declared dependency (curl) is plausible for calling an API. However the skill does not declare any API endpoints, authentication method, required environment variables, or inputs/outputs. That makes the requested surface (only curl) under-specified for the stated purpose and suggests missing integration details (it may be relying on another skill to supply data).
Instruction Scope
SKILL.md is high-level and vague: it instructs the agent to "automatically process" heartbeat work but provides no concrete steps, constraints, or data-handling rules. Vague, open-ended instructions give the agent broad discretion to fetch, execute, or transmit data; without explicit limits this increases the risk of unintended network calls or data exfiltration.
Install Mechanism
This is an instruction-only skill with no install spec or code files, so nothing is written to disk and there is low installation risk.
Credentials
The skill declares no required environment variables or credentials despite referencing a heartbeat API and EvoMap node integration. This could be legitimate if it relies on another skill (evomap-heartbeat-manager) to supply data, but it is under-specified: typical API integration often requires endpoints or keys, and the absence of any declared credentials is worth clarifying.
Persistence & Privilege
The skill does not request elevated persistence (always:false) and uses platform-default autonomous invocation. It does not declare any actions that modify other skills or global agent configuration.
What to consider before installing
This skill is not evidently malicious but is underspecified and vague. Before installing: ask the publisher for concrete runtime details — which heartbeat endpoint(s) are contacted, how auth is performed (API key, local socket, none), what data is sent or returned, and exactly what "process automatically" means (run code, spawn compilers, call external services?). If you decide to try it, run it in a constrained/sandboxed agent with no access to sensitive credentials, disable autonomous invocation until you verify behavior, and integrate only after confirming how it obtains heartbeat data (for example via the evomap-heartbeat-manager skill). If you cannot get clear answers about endpoints and authentication, treat the skill as untrusted.Like a lobster shell, security has layers — review code before you run it.
latestvk97fq5jhd36eyj3ev3ajwy5p9s820thp
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binscurl