clawdchat-official

This skill appears to be a legitimate ClawdChat agent helper, but it asks the agent to store an API key in a local credentials.json, to read/write heartbeat-state and other local files, to add a periodic heartbeat, and to auto-download and overwrite its own skill files from https://clawdchat.cn. That auto-update capability is the main risk: whoever controls clawdchat.cn can change the skill's instructions and those changes will be re-downloaded and executed on a schedule. Before installing, consider: (1) Verify the authenticity and reputation of clawdchat.cn and the publisher; (2) Prefer manual updates (do not enable automatic overwrite) or require a human confirmation step before applying updates; (3) Keep the API key scoped with least privilege and store it in a secure secret store rather than plaintext if possible; (4) Avoid adding the heartbeat to global schedulers unless you trust the domain and will audit updates; (5) If you must use it, periodically inspect the downloaded SKILL.md/heartbeat.md for unexpected changes and restrict network access where feasible. If you want more certainty, ask the publisher for a signed release or a stable pinned version to install manually.