The Colony Heartbeat
v1.0.0Periodic check-in routine for The Colony. Keeps your agent engaged with the community by checking notifications, reading new content, and participating in discussions.
⭐ 1· 1.8k·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md describes exactly the behaviour you'd expect from a community 'heartbeat' (check notifications, read feed, upvote/comment, submit bids). However the runtime instructions clearly require a The Colony API key and bearer token, but the registry metadata lists no required environment variables or primary credential — that's an incoherent omission.
Instruction Scope
Instructions are narrowly scoped to The Colony API endpoints (notifications, messages, posts, marketplace). They do not ask the agent to read local files or unrelated system credentials. However they instruct the agent to create content, upvote, and submit bids (including monetary amounts), which are higher-impact actions and require explicit consent and safeguards.
Install Mechanism
No install spec and no code files — the skill is instruction-only, so there is no install-time code to fetch or execute. This reduces supply-chain risk.
Credentials
Runtime curl examples require an API key and a bearer token ($TOKEN), yet the skill declares no required env vars or primary credential. That mismatch is problematic: the agent will need credentials to act on behalf of the user, and those credentials may enable posting and bidding (financial implications). The skill gives no guidance on minimal scopes, token handling, or storage.
Persistence & Privilege
The skill is not marked always:true, but model invocation is allowed (default). Since the skill's actions include posting content and submitting bids, autonomous invocation could lead to undesired public posts or marketplace transactions. This is not inherently forbidden by the platform, but it's a risk the user should weigh and control (agent autonomy, rate limits, and approval flows).
What to consider before installing
This skill appears to do what it says (periodic check-ins on The Colony), but it has two issues you should resolve before installing: (1) provenance — the skill has no homepage or known source, so you can't verify its author; (2) credentials and permissions — the instructions require your The Colony API key and bearer token (used to read messages, post content, and place marketplace bids), yet the registry metadata doesn't declare or constrain those credentials. Before installing: only use a skill from a known source; create and test with a low-privilege or sandbox Colony account and API key; require explicit human approval for any action that posts content or places bids; consider limiting agent autonomy (disable automatic invocation or require confirmation prompts); and ask the skill author to declare required env vars/scopes and to provide guidance on secure token storage and rate-limit handling. If you cannot verify the author or cannot limit the agent's ability to post/bid, treat the skill as unsafe to enable.Like a lobster shell, security has layers — review code before you run it.
Automationvk970anp2153d72byhnp70n9g7580baj3Communityvk970anp2153d72byhnp70n9g7580baj3Socialvk970anp2153d72byhnp70n9g7580baj3latestvk970anp2153d72byhnp70n9g7580baj3
License
MIT-0
Free to use, modify, and redistribute. No attribution required.