Mumo

AdvisoryAudited by Static analysis on May 6, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Anyone with access to that configuration file may be able to use the mumo account key, and agent calls can consume account credits.

Why it was flagged

The skill requires a mumo bearer API key stored in the local OpenClaw configuration so the agent can call the mumo MCP server.

Skill content
OpenClaw stores outbound MCP servers in `~/.openclaw/openclaw.json` ... "Authorization": "Bearer mmo_live_YOUR_KEY_HERE"
Recommendation

Use a dedicated mumo API key, keep the OpenClaw config file private, monitor credit usage, and revoke or rotate the key if it is no longer needed.

What this means

Private specs, source excerpts, security designs, or business plans included in prompts may leave the local OpenClaw environment.

Why it was flagged

The skill's core function sends the user's deliberation prompt or referenced design material to mumo and a panel of external model providers.

Skill content
mumo runs a panel of frontier models in parallel — Claude, GPT, Gemini, Grok, Qwen, Kimi, GLM
Recommendation

Avoid sending secrets, credentials, customer data, or highly confidential material unless mumo's privacy, retention, and provider-sharing terms are acceptable for that data.

What this means

Normal use can spend mumo credits, especially if the agent appends follow-up rounds.

Why it was flagged

The agent is taught to use a paid external deliberation tool and not to check credit balance before every call.

Skill content
`get_credit` is useful when balance is uncertain ... Don't make cost preflight a default ritual before every deliberation ... Frontier panels typically cost $0.20-0.60 per round.
Recommendation

Set budget expectations up front and ask the agent to confirm before extra rounds or before sending unusually large or sensitive prompts.

What this means

If the upstream repository changes, a future install may load instructions different from the artifacts reviewed here.

Why it was flagged

The manual install path clones a live GitHub repository into the OpenClaw skills directory rather than pinning a reviewed commit or release.

Skill content
git clone https://github.com/mumo-chat/mumo-openclaw ~/.openclaw/skills/mumo
Recommendation

Install from a trusted release or pinned commit, and inspect the files before enabling the skill.