Skill

What to consider before installing: - This skill gives an AI wide control and read access to a phone (read/send SMS, notifications, files, location, clipboard, make calls, run limited shell). Treat it as highly sensitive. - Metadata mismatch: the registry lists no required binaries but SKILL.md requires node and an MCP server — verify this difference and confirm you are comfortable running a local Node server and installing the Android app. - Webhooks/callbacks: by enabling OpenClaw callbacks you allow the phone to POST event data (notification text, SMS, etc.) to the configured agent endpoint; ensure that endpoint is local/trusted, uses TLS and authentication, and will not forward data externally unintentionally. - Source verification: SKILL.md points to a GitHub repo and releases. Review the repository, confirm release integrity (checksums/tags), and prefer running the server in an isolated environment or on a spare device first. - Least privilege: if you test, use a spare device with minimal personal data and restrict network exposure (avoid exposing MCP or callbacks to the open internet; if using Tailscale, apply access controls). - Audit 'aster_execute_shell' and file-access behaviors to confirm the documented sandbox/limits are actually enforced, and confirm the device-approval workflow is enforced in practice. - If you are not comfortable reviewing the code or configuring secure callbacks, do not install this on a primary device. Additional useful info to reduce uncertainty: provide the package name/version on npm, release checksums, and a pointer to the specific commit/release so the code can be audited.