ℹ
Purpose & Capability
The code and docs implement forum integration, registration, heartbeat cron jobs, and automated interactions to earn Karma — which is coherent with the skill's stated goal of obtaining/using a 7-day trial. However the name/description implies direct 'Minimax M2.7' access while several docs explicitly state the trial uses an OpenRouter proxy and you cannot directly call 'minimax' endpoints; that's a mismatch between marketing and actual capability.
!
Instruction Scope
SKILL.md and included files instruct the agent (and the user) to read sensitive credentials (SINGULARITY_API_KEY, agent/node secrets) from environment variables or well-known config files, add persistent cron jobs, and install/configure an OpenClaw WebSocket plugin. The heartbeat script performs account actions (apply genes, upvote posts, post comments) autonomously. Those behaviors go beyond passive querying and will perform write actions on your forum account — the instructions do not limit frequency or content of comments and recommend auto-ack and short heartbeat intervals.
ℹ
Install Mechanism
No external install/download spec is provided (instruction-only), but the skill bundle includes runnable JS files (index.js, lib/*). That means code will run locally if invoked, but nothing in the package reaches out to arbitrary third-party download URLs or uses obfuscated installers. Risk from install is low, but included scripts are capable of network activity and file reads.
!
Credentials
The registry metadata declares no required environment variables, yet SKILL.md and lib/config.js clearly expect SINGULARITY_API_KEY, SINGULARITY_AGENT_ID, SINGULARITY_NODE_SECRET (or a credentials.json at ~/.config/singularity or %APPDATA%). Requesting an API key and node secret is reasonable for forum integration, but the omission from declared requirements is an incoherence. These are high-value secrets (API keys) and the skill will read them and use them to perform write operations on your account.
!
Persistence & Privilege
The skill recommends creating cron jobs (every 4h) and configuring a persistent OpenClaw WebSocket plugin with short heartbeat intervals (example uses 15s). While the skill itself isn't forced always-on by the registry, its documentation encourages installing persistent automation that will continuously act with your account credentials, increasing blast radius if those credentials are exposed or misused.
Scan Findings in Context
[READ_CREDENTIALS_FILE] expected: lib/config.js intentionally reads ~/.config/singularity/credentials.json or %APPDATA%/singularity/credentials.json to obtain apiKey/agentId/nodeSecret; this is expected for a forum-integration skill but should have been declared.
[NETWORK_REQUESTS_TO_FORUM] expected: lib/api.js makes many fetch() calls to https://www.singularity.mba endpoints (home, posts, evomap, experience-cards). Network activity to the forum is required for the declared functionality.
[AUTOMATED_ACCOUNT_ACTIONS] expected: lib/heartbeat.js upvotes posts, posts comments, applies genes and sends heartbeats. Those write actions are coherent with the Karma-earning purpose but have potential for misuse if run without oversight.
[INCONSISTENT_MARKETING] unexpected: The skill name/description emphasize 'Minimax M2.7 free access', yet docs state trial usage goes through an OpenRouter proxy and explicitly note you cannot directly request 'minimax' endpoints. This looks like marketing overstating direct model access.
What to consider before installing
Before installing or enabling this skill: 1) Understand it needs your forum API key/node secret (high-value credentials). The registry omitted these requirements — verify you are comfortable providing them. 2) The skill recommends persistent automation (cron jobs, a WebSocket plugin) that will perform write actions on your account (upvotes, comments, heartbeats). Only enable persistent cron/plugin if you trust the service and understand the actions and cadence. 3) If you only want to test the trial model, consider using a disposable or secondary forum account rather than your primary account. 4) Review lib/config.js, lib/heartbeat.js, and lib/api.js yourself (they are plain JS and readable) to confirm no additional external endpoints or obfuscated behavior. 5) Note the mismatch: the package markets direct Minimax M2.7 access but documentation indicates calls are proxied via OpenRouter; ask the owner to clarify if you need direct Minimax access. 6) If you proceed, monitor account activity and remove cron/plugin configuration when you no longer need automated interactions.
