🦄 Unicon CLI

Add and manage 19,000+ icons from 9 libraries in React, Vue, Svelte, or web projects using the Unicon CLI for search, bundles, previews, and tree-shakable co...

This skill appears to do exactly what it says: it requires node and installs the @webrenew/unicon npm CLI which will read package.json, create/modify `.uniconrc.json`, and generate icon component files in your project. If you plan to install it globally, consider: (1) prefer using npx or a local devDependency if you don't want a global binary; (2) review the package source on npm/github (https://github.com/WebRenew/unicon and https://unicon.sh) before installing to confirm behavior; (3) be aware that running `unicon skill --all` or similar will write assistant/IDE files into many directories — run that only if you intend it; (4) no credentials are required, but you may want to audit the generated files produced in your repo and CI. Overall there are no incoherent or disproportionate requests in the skill materials.

Type: OpenClaw Skill Name: unicon Version: 0.2.0 The skill is classified as suspicious primarily due to the `unicon skill` command described in `SKILL.md` and `references/cli-commands.md`. This command allows the CLI to write files (e.g., `SKILL.md`, `.mdc`) into configuration directories of other AI assistants (e.g., `.claude/skills/`, `.cursor/rules/`, `.agent/rules/`). While intended for installing helpful skills, this capability introduces a significant vulnerability for cross-agent prompt injection or supply chain attacks if the `unicon` CLI itself were compromised or misused. Additionally, the tool makes external API calls to `https://unicon.sh/api`, which can be redirected via the `UNICON_API_URL` environment variable, presenting another potential vector for misuse.