A Stock

What to check before installing/using: 1) Confirm the skill source (review the GitHub repo at the provided homepage) to ensure it matches the package you installed. 2) Verify the metadata mismatch: SKILL.md requires ASTOCK_API_KEY and Node/npx, but registry metadata omitted these — treat that as a packaging error and confirm requirements. 3) Avoid running the script from directories containing other .env files with unrelated secrets; prefer setting ASTOCK_API_KEY as an explicit environment variable or create a dedicated project directory with a minimal .env. 4) Inspect scripts/api-client.ts yourself (it is short): it only reads ASTOCK_API_KEY and calls https://api.aipmedia.cn; if you trust that service, the behavior is consistent. 5) If you have concerns about leaking the API key, isolate the process (container/VM) or review network egress controls; otherwise the key will be sent to api.aipmedia.cn as intended. 6) If you want higher assurance, ask the publisher to fix the package metadata to declare required env vars and runtime binaries. If any of these points are unclear or you want help checking the repo contents or running the script in a safe environment, I can assist.

These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.