UniSkill V4
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's files and runtime instructions are coherent with a minimalist AI-agent / debate engine: it doesn't request unrelated credentials or perform obvious exfiltration, but origin is unknown and there are a few integration/runtime details you should check before installing.
What to check before installing - Source/trust: the skill's origin/homepage is unknown; prefer installing from a verified GitHub/PyPI source and confirm repository contents match. - Automatic triggering: the gateway auto-triggers on many keywords (CNC, decision words). If you don't want automatic runs, disable autonomous invocation or review agent trigger rules. - Future network/model calls: model-calling code is currently stubbed/heuristic with TODOs mentioning sessions_spawn and cloud/local models. If later versions add remote model calls, they may require credentials — only allow that from trusted sources. - Runtime dependencies: orchestrator imports psutil at runtime but requirements.txt does not include it; running in your environment may raise ImportError. Install and test in a sandbox or virtualenv and run the included tests (pytest) before enabling in production. - Path insertion: INTEGRATION.md and the gateway manipulate sys.path and reference an OpenClaw workspace location — ensure this won't inadvertently cause module shadowing or import of unexpected code in your environment. - Review logs and metadata: provided logs and scripts (github-release.sh) include author emails and repo URLs; verify these links before trusting published packages. Recommended actions: run the package in an isolated environment, run the provided tests, inspect the code for any later commits that add external network calls or credential usage, and only enable automatic invocation if you understand and accept the trigger rules.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
No visible risk-analysis findings were reported for this release.