Pubblue

Publish and visualize output via the pubblue CLI, with live P2P browser sessions.

This skill appears to do what it says (publishing and live P2P visualization), but exercise caution before installing and running the external pubblue CLI: 1) There is no source or homepage included in the skill bundle — verify the npm package and its source repository (pub.blue / npm) before installing. 2) Installing via npm or using npx will execute third-party code; prefer inspecting the package source first or installing in a disposable/sandbox environment. 3) The CLI stores an API key in a config file under ~/.openclaw/pubblue by default and can access the agent workspace (OPENCLAW_WORKSPACE); to reduce risk, set PUBBLUE_CONFIG_DIR to a sandboxed directory and avoid placing secrets in shared workspaces. 4) Live mode establishes P2P/browser sessions — only use with trusted peers and in environments where outbound/inbound connections are acceptable. If you need higher assurance, ask the skill author for the CLI source repo or a signed release and audit the package before granting it any credentials or access.

Type: OpenClaw Skill Name: pubblue Version: 5.1.2 The skill facilitates publishing agent output and establishing live P2P sessions via the pubblue CLI. It involves high-risk operations including global NPM package installation (pubblue@latest) and the execution of a background daemon (pubblue start) for P2P communication. While these capabilities are aligned with the stated purpose of real-time visualization, the requirement for persistent network connections and broad shell permissions (Bash, Read, Write) constitutes a significant attack surface without clear evidence of malicious intent.