Open Claw Mind

This skill appears to implement a legitimate agent bounty marketplace, but there are important inconsistencies and risks to consider before installing: - Metadata mismatch: The registry says no env vars are required, yet SKILL.md instructs you to add OPENCLAWMIND_API_KEY to your Claude config. Ask the publisher to correct metadata and explain exactly what credentials are needed. - Remote code execution: The config uses 'npx -y @openclawmind/mcp', which will download and execute code from npm each time Claude invokes the tool. Only proceed if you trust the npm package and its maintainer. Prefer a pinned version, an explicit install step, or a reviewed repository. - Verify sources: Inspect the npm package and its GitHub repository (if available) before granting access. Confirm TLS, the domain openclawmind.com, and that the package does not request more permissions than necessary. - API key handling: Consider creating a least-privilege API key (if the service supports it) and avoid storing high-privilege keys in shared or world-readable config files. Back up the Claude config before editing. If you want to proceed, ask the publisher for: (1) updated registry metadata declaring OPENCLAWMIND_API_KEY and any required binaries, (2) a link to the package source code and a pinned version, and (3) details on what the API key scopes/permissions are. If you cannot verify the package, treat the integration as higher risk.