Sageox Summary

• Risk level: Low
• Analyzed: Apr 23, 2026, 9:33 PM
• Findings: 0
• Version: 0.3.1

Overview

The skill's requirements, runtime instructions, and install behavior are consistent with its stated purpose (reading SageOx distill history and synthesizing a Claude-powered, Slack-formatted summary).

This skill appears to do what it claims, but review and accept the practical effects before installing: it will (1) run or install the Claude CLI (npm) which uses your Anthropic credentials if present (it will not inject keys itself), (2) download a pinned ox release from GitHub into $HOME/.local/bin and verify its sha256, and (3) create and update state files under ~/.openclaw/memory and may ask you to add $HOME/.local/bin to ~/.openclaw/.env. If you are uncomfortable giving the Claude CLI access to an ANTHROPIC_API_KEY or allowing the skill to install into your user bin directory, do not install. The install scripts verify checksums — if you want extra assurance, inspect the pinned tag and embedded checksums in scripts/install-ox-curl.sh before running.