Mrc Monitor

This skill appears to do what it says, but there are transparency and configuration issues you should address before installing: - The script contains a hard-coded Firebase API key and project ID. Confirm you trust embedding that key (and verify its exact permissions). Prefer moving the key to an environment variable or secret store and update SKILL.md/manifest to declare it. - The code calls an external 'openclaw' CLI to send messages and uses the 'requests' Python package; the manifest declares no required binaries or dependencies. Ensure the runtime has python3, the requests library, and the openclaw CLI available, or update the manifest to declare these requirements. - The monitor writes logs to skills/mrc-monitor/logs. Confirm log storage and retention policies and that logs don't leak sensitive order/student info. - The script fetches the entire orders collection on every poll. Verify this is acceptable from a privacy standpoint and that the Firebase project is the correct one. - Because the agent will spawn a background process, understand that process runs with the agent's permissions and will continue until tokens are ready or it times out; plan for cleanup and resource usage. If you cannot verify the API key and the presence/behavior of the openclaw CLI, treat this skill as untrusted. At minimum, require the key be moved out of source and the external CLI/dependencies be declared before use.