Komandr

What to consider before installing: - The bridge will send the KOMANDR_API_KEY (a secret starting with km_) to whatever KOMANDR_URL you configure (default https://komandr.vercel.app). Only use a key you trust the remote service with. Prefer a least-privilege or ephemeral key. - The registry metadata omitted the required environment variables and gives no homepage or provenance. That can be an oversight but reduces trust — prefer packages with clear authorship and documentation. - The skill lets humans assign arbitrary tasks that the agent is expected to execute. If you enable autonomous invocation, an agent could be instructed to access networks, generate code, or operate on repositories; consider running this skill in a sandboxed environment. - Review the included script (scripts/komandr-bridge.ts) yourself — it is small and does only HTTP calls using the API key. If you accept this skill, verify the KOMANDR_URL is an expected host, and consider monitoring outbound traffic or using an allowlist. - If you need to proceed: create a limited-scope Komandr API key, avoid using high-privilege credentials, verify the server TLS certificate/hostname, and update the registry metadata to include required env vars so the manifest matches behavior. - If you require higher assurance, ask the publisher for a homepage, source repository, and signed release artifacts before installing.

These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.