Sageox Distill

• Risk level: Low
• Analyzed: Apr 23, 2026, 9:34 PM
• Findings: 0
• Version: 0.2.1

Overview

The skill's requirements, install steps, and runtime instructions are coherent with its stated purpose (syncing repos, indexing GitHub activity, and running a distillation pipeline), with one small documentation mismatch about Anthropic credentials.

This skill appears to do what it claims, but review these points before installing: - You must provide authentication for Anthropic (claude) and GitHub; SKILL.md explains either 'claude login' or exporting ANTHROPIC_API_KEY, but the registry metadata does not declare that env var — be prepared to supply it yourself. - The skill will download a pinned 'ox' release from GitHub Releases and install it to $HOME/.local/bin; the installer verifies sha256 and the binary's reported version. If you have policy concerns, inspect scripts/install-ox-curl.sh and confirm the pinned tag and checksums are acceptable. - Installing 'claude' via npm and gh/jq via brew requires network access and installs third-party code — verify you trust those packages and their permissions before proceeding. - The skill will read/write state in ~/.openclaw/memory and may ask you to add $HOME/.local/bin to ~/.openclaw/.env. These are local changes; review the files if you want to audit them first. - If you need higher assurance, run the two included scripts manually (scripts/install-ox-curl.sh and scripts/update-ox.sh) and review their stdout/stderr before letting the agent run them automatically. If you are comfortable granting the above (local install, providing API keys for Anthropic/GitHub), the skill is internally consistent with its purpose.