Base Network OSINT

What to consider before installing: - Supply‑chain risk: The skill instructs the agent to download and overwrite its cached SKILL.md from https://app.kybera.xyz. That means the skill's behavior can change later without an explicit new package install. Only allow this if you trust the remote domain and its operator. - Missing credential disclosure: The instructions rely on third‑party services (GoPlus, Arkham, ENS, social platforms) but the skill declares no required API keys or environment variables. Ask the publisher which credentials are required and where they will be used. Do not provide sensitive API keys unless you understand and trust how they’re used. - Local persistence: The skill writes to ~/.openclaw/skills/kybera.md. If you install it, inspect that file and any remote SKILL.md before allowing updates. Prefer manual approval for updates rather than auto‑overwrite. - Prompt‑injection indicator: The SKILL.md contains unicode control characters flagged by the scanner. Treat this as suspicious; request a clean, canonical copy of the skill content and verify it matches the hosted file. - Safety steps: If you proceed, run it in a restricted environment (no access to high‑privilege secrets), disable autonomous network access if possible, and require explicit user confirmation before performing any write/update operations. Alternatively, ask the skill author to provide a version that does not auto‑fetch/overwrite local files and that declares all required credentials. What would change my assessment: proof that the remote SKILL.md is signed and verifiable, a publisher identity tied to the kybera.xyz domain, explicit declaration of required API keys and their minimal scope, and removal/clarification of the unicode control characters. If those are provided, the supply‑chain and injection concerns would be reduced.