Ponddepth Levels

Leveling overlay for OpenClaw Control UI (badge + XP + daily tip + level list + icons).

This package is not obviously malicious, but it includes unexpected capabilities and some sloppy/incompatible parts. Before installing: - Inspect the scripts locally (install.sh, uninstall.sh, and all tasks). Verify you are comfortable with files being copied into your OpenClaw Control UI assets directory and that you have backups. - Note the package will attempt to create OpenClaw cron jobs that run the included Python scripts. If you do not want scheduled runs, do not allow cron creation (or run the install script but skip the cron commands). - Look closely at tasks/skill_install_queue.py — it can run `clawhub install <name>` from a queue file. If you do not want automatic or queued installs, remove or disable this script. - Fix or confirm path usage: one script uses hardcoded /Users/aibaobao paths (likely a bug). Ensure the tasks will read only directories you expect (use OPENCLAW_WORKSPACE and OPENCLAW_UI_ASSETS_DIR overrides when running the installer). - Confirm the expected extension files (openclaw.plugin.json, index.ts) are present in the workspace extension dir or adjust the install script; the install currently expects them but they are not included in the published files. - Consider running the install steps in a controlled environment (temporary VM or container) first, or run the install script line-by-line in a shell to see exactly what it changes. If you proceed, keep the uninstall script handy and verify the backup created under ~/.openclaw/workspace/_deleted/ before making other changes.

Type: OpenClaw Skill Name: ponddepth-levels Version: 0.1.1 The skill bundle implements a UI gamification overlay by injecting JavaScript and assets directly into the global OpenClaw installation directory (/opt/homebrew/lib/node_modules/openclaw/), which is a high-risk persistence and execution vector. It includes a background task (tasks/skill_install_queue.py) that automatically executes shell commands ('clawhub install') based on a local JSON queue, which could be exploited to install unauthorized packages. Furthermore, tasks/companion_metrics.py contains hardcoded absolute paths to a specific user's home directory (/Users/aibaobao/), representing a significant functional flaw and a leak of the developer's environment details. While the behavior aligns with the stated purpose of a 'leveling overlay,' the combination of global file modification and automated command execution warrants a suspicious classification.