Threat Radar

What to consider before installing: - Ask the publisher for a homepage/source and documentation that explains how alerts are delivered (what webhook/tokens are required) and where they are stored. The skill promises WhatsApp/Telegram/Discord alerts but declares no credentials — do not assume alerts are configured automatically. - Review the remainder of threat_radar.py (the parts not shown) to confirm how it sends notifications and what network endpoints it calls. Look specifically for any hard-coded endpoints, webhook URLs, or obfuscated network calls. - Confirm what `cron-install` modifies: ask for the exact code or commands it runs. Prefer to run scans ad-hoc first rather than enabling scheduled tasks system-wide. - Because the scanner reads package manifests, Docker images, and OpenClaw config and writes logs/DB under ~/.openclaw, run it in a restricted test environment (or container) first to verify behavior and avoid exposing production credentials or sensitive files. - If you want to use alerting channels, require explicit configuration: webhook URLs or tokens should be set by you and documented; do not provide any broad credentials (SSH keys, cloud keys) unless absolutely necessary and justified. - If the publisher cannot provide source/installation clarity or the code that performs notifications, treat this skill as untrusted. What would change this assessment: seeing the full source for notification/cron-install code (showing it only uses user-supplied webhook URLs and documents cron changes), or a clear install spec that safely registers the CLI and documents required credentials would reduce the concerns.