mia

What to check before installing: - The skill will read/write plain JSONL files (memory and feedback) under its directories by default; review and control the file paths (MIA_MEMORY_FILE, MIA_FEEDBACK_FILE) and file permissions to avoid accidental storage of sensitive data. - The metadata in the registry marks MIA_PLANNER_API_KEY and other planner vars as required, but the code only needs the API key when MIA_PLANNER_MODE=api. If you don't want to provide an external API key, set MIA_PLANNER_MODE=local and configure MIA_PLANNER_URL to a local model. Don't provide cloud API keys unless you intend to use api mode. - There are duplicated files and a coding bug: memory code calls extractPattern() which is not defined. This indicates the package may be untested and could throw runtime errors or behave unexpectedly. Consider reviewing the code locally and running in an isolated/test environment first. - npm install will fetch node-fetch from the public npm registry (standard dependency) — run installs in a controlled environment if you are cautious about third-party packages. - If you plan to use this skill in production, inspect the code, run it in a sandbox, and consider encrypting or restricting access to memory/feedback files. If you need help verifying the undefined function or cleaning up the metadata, get a developer to audit/fix those issues before trusting persistent data or production API keys.

These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.