ohmyopenclaw

Before installing or allowing this skill to run automatically: - Do not run the provided 'curl | bash' or PowerShell 'iex' installer without auditing the remote script; prefer a vetted release (GitHub release tarball, signed binary, or manual inspection). The domain used by the installer (get.ohmyopenclaw.dev) is not a known trusted host. - Review the repository and installer script contents (or ask the author for a release tarball) so you know exactly what will be written and executed on your machine. - Expect the guides to request many API keys and to modify local config files under ~/.openclaw; only provide credentials you trust and store them securely (do not paste secrets into chat). - Be cautious about enabling cron jobs/heartbeats and webhooks: they cause periodic scanning and external callbacks. Inspect any webhook endpoints and restrict network access (use firewall rules, vetted endpoints). - The monitoring guide instructs scanning /var/log/myapp and GitHub issues; if you enable those, ensure the agent has only the minimum required file access and that sensitive logs are not exposed. - If you want to proceed, consider: (1) manually applying guide steps instead of granting autonomous execution; (2) running the installer in an isolated environment or container; (3) backing up existing openclaw.json and workspace files so you can revert changes; (4) limiting the skill's access to credentials and network at the OS or container level. Reason for rating: the skill is generally coherent with its stated purpose but includes high-risk installer commands, undocumented secret requirements, and instructions that allow system-level scanning and network callbacks — together these are suspicious and warrant manual review before trusting automatic installation or autonomous operation.