NormieClaw Full Stack

Every NormieClaw skill in one download. 34 production-tested OpenClaw skills covering productivity, finance, health, education, content creation, and more. I...

This bundle contains a lot of local scripts and many SKILL.md files — treat it as untrusted code until you verify it. Before installing: 1) Verify provenance: who published it, are there checksums or a signed release, is there an official homepage or Git repo? 2) Inspect the top-level SKILL.md and each SETUP-PROMPT block for any hidden/injected content (look for the flagged phrases and for invisible unicode chars). 3) Do NOT paste the provided setup block into a production agent chat or run it on your main workstation without review — that block asks the agent to execute filesystem operations; run similar steps yourself manually in a sandbox if you decide to proceed. 4) Run the code in an isolated environment (VM or container) or on a throwaway account first; check scripts for any network calls, remote endpoints, or commands that might overwrite critical files. 5) Search the repository for suspicious patterns (curl/wget to external hosts, base64/decode/exec, git remote add, ssh, scp, rsync, nc/socat) and review any scripts that will be executed by the agent (shell scripts and python scripts). 6) If you want this package but don't trust the bundle, extract only the individual skills you need and audit them separately. Additional information that would raise confidence: a known publisher/homepage, cryptographic signatures or checksums, or an independent security audit for the full bundle.

Type: OpenClaw Skill Name: normieclaw-full-stack Version: 1.0.0 The NormieClaw Full Stack bundle is a comprehensive and well-architected collection of 34 skills that follow high security standards for the OpenClaw ecosystem. The package includes robust defensive measures, such as explicit prompt-injection defense instructions in every SKILL.md file and the use of restrictive file permissions (chmod 600/700 and umask 077) in setup scripts like health-buddy-pro/scripts/health-buddy-init.sh. Python and Bash scripts utilize path canonicalization and strict regex-based input validation (e.g., hireme-pro/scripts/generate-resume-pdf.sh and party-planner-pro/scripts/export-plan.sh) to prevent path traversal. All network activities, such as SEC EDGAR checks, are purpose-aligned and transparent, while PDF generation scripts (docuscan/scripts/generate-pdf.py) explicitly disable JavaScript and block non-local requests to prevent exfiltration. No malicious intent or critical vulnerabilities were identified.