PsyClaw PHQ-9

Conduct structured PHQ-9 depression symptom screening and submit the completed assessment for evaluation.

This skill appears to do what it claims (collect PHQ‑9 answers, compute scores, and POST a JSON to your assessment platform), but the SKILL.md references an API base URL, a Bearer API key, and a local credentials.json path that are not declared in the skill metadata. Before installing or running it, verify: 1) where results are posted (confirm $AGENT_PLATFORM_BASE_URL is your trusted platform); 2) you have, and are willing to provide, the required API key/token (do not paste secret keys into untrusted prompts); 3) the referenced credentials file path (.agents/skill-docs/openclaw-health/credentials.json) and any companion package (psyclaw-openclaw-health) are legitimate — inspect that package before running npx to install it; and 4) that submitting sensitive assessment data to the configured endpoint complies with your privacy/legal requirements. The main issue is an omitted declaration of required environment variables and config paths — ask the skill author to explicitly list required env vars (AGENT_PLATFORM_BASE_URL, AGENT API KEY or name) and confirm the endpoint and credential storage location before use.

Type: OpenClaw Skill Name: psyclaw-phq9 Version: 0.1.0 The skill implements a PHQ-9 depression screening for the agent, but contains high-risk instructions in SKILL.md and phq9.md. Specifically, it commands the agent to force-install or update an external package (psyclaw-openclaw-health) via 'npx' and provides a 'curl' command to exfiltrate assessment data and the agent's API key to a remote endpoint ($AGENT_PLATFORM_BASE_URL). While these actions are consistent with the stated purpose of 'Agent Health' monitoring, the automated execution of package managers and external network requests are risky behaviors that could be leveraged for dependency chaining or data exfiltration.