swarma - growth loops

Agent teams that run growth experiments and build their own playbook. GROWS loop: generate hypothesis, run experiment, observe signal, weigh verdict, stack p...

This skill appears to implement the advertised growth-experiment loop, but there are a few mismatches and practical risks to address before installing: - Confirm required credentials: SKILL.md requires OPENROUTER_API_KEY for LLM usage but the registry shows no required env vars. Only provide this key if you trust the upstream code and understand its LLM usage and limits. - Confirm install/source: SKILL.md refers to Python/pip and a GitHub repo but the registry has no install spec. Ask the publisher for an explicit install plan (exact pip package name or vetted release URL) and inspect the repository before running pip install. - Sandbox runtime installs and servers: Because the skill can start servers (REST/MCP) and a scheduled engine, consider running it in a sandboxed environment (container or VM) and restricting network exposure until you audit the code. - Review code/repo: Before giving any API keys or allowing autonomous runs, review the repository (https://github.com/glitch-rabin/swarma) or ask the author for a trustworthy release. Look for unexpected network calls, telemetry, or credential exfiltration code. - Least privilege: Provide only the minimum API key scope needed for OpenRouter (or prefer ephemeral/test keys) and avoid supplying high-privilege secrets (cloud credentials, SSH keys, database passwords). If the publisher can (a) add an explicit install spec, (b) reconcile registry metadata with SKILL.md (declare OPENROUTER_API_KEY requirement), and (c) provide a vetted release link or package name, that would materially reduce the uncertainty.

Type: OpenClaw Skill Name: swarma Version: 1.0.0 The 'swarma' skill is a growth experimentation framework designed for agent teams to run A/B tests and build playbooks. The SKILL.md documentation provides legitimate instructions for managing experiment cycles, logging metrics, and configuring agent squads via a CLI or MCP interface. No indicators of malicious intent, data exfiltration, or harmful prompt injection were found; the requirement for an OPENROUTER_API_KEY is consistent with its stated purpose of performing LLM-based tasks.