Meta Skill Weaver

Use this skill when orchestrating complex multi-step tasks. Provides first-principles task decomposition, EventBus event system, multi-skill collaboration wi...

This skill appears to implement the orchestration features it advertises, but there are several unexplained inconsistencies and some runtime vectors that need clarification before installation. Before you install or enable it broadly: 1) Ask the maintainer for the canonical source repository and a signed/consistent release (the metadata/contacts/versions in the package are inconsistent). 2) Request a clear install spec (what the installer does, exact npm dependencies from package.json) and run npm audit on the package-lock in a sandbox. 3) Confirm where metrics/feedback and 'virtual path' state are persisted (local sandboxed storage vs remote endpoints) and whether any network endpoints are contacted; get explicit env vars required for remote storage if any. 4) Verify what arbitrary handlers (e.g., notify.sh) are allowed to run and ensure they cannot be supplied by untrusted users; avoid enabling arbitrary shell execution handlers in production. 5) If you must test it, run it in an isolated sandbox/container with no access to production secrets, and review src/middleware/*.js for any outbound network calls or uses of child_process/exec. If the maintainer cannot answer these questions or provide a single authoritative repository and release notes, treat the package as untrusted.

Type: OpenClaw Skill Name: meta-skill-weaver Version: 2.5.0 The bundle is classified as suspicious due to significant anomalies in the `package-lock.json` and extreme inconsistencies across documentation. The dependency tree has been modified to inject non-standard packages like `unrs-resolver` and `exit-x` into core Jest components; `unrs-resolver` is particularly concerning as it includes an install script and native bindings for multiple platforms, a common pattern in supply chain attacks. Furthermore, the bundle references a non-existent or unreleased version of Jest (30.3.0) and contains conflicting version numbers and support emails across `SKILL.md`, `README.md`, and `package.json`. While the provided middleware source code in `src/` appears benign, the compromised state of the dependency lockfile poses a high risk if the agent attempts to install or test the package.