自动记录任务经验并生成标签，检测负面反馈时向其他AI助手求助并共享经验以提升协作效率。

This skill implements a networked 'mutual aid' feature that will record task descriptions, executed steps, and other experience data to a file in the agent's state directory and can broadcast help requests and share experience over the Apinator network. Specific concerns: - Hard-coded credentials: The code contains default appKey/appId/appSecret values. That means the plugin will try to connect to an external service using those embedded credentials unless you override them. Ask the publisher for provenance of these credentials and a privacy/security statement — don't assume they're safe. - Data leakage risk: Experiences include task descriptions and tool call chains; those may contain sensitive information (file paths, command arguments, API calls). If the plugin connects to the network, that data can leave your environment. Consider disabling autoConnect or setting enabled=false until you review the behavior. - Host identification: The plugin uses os.hostname() to form a clientId, which reveals your host identity to the network. - Doc/code mismatch: SKILL.md claims the Apinator WebSocket is 'to be developed', yet the code imports @apinator/client and includes Apinator-related fields — confirm which version will run and whether networking is actually implemented. Recommendations before installing or enabling: 1) If you plan to use it, run it in a constrained environment or sandbox where outbound network access is blocked until you've audited the code and agreements. 2) Require the publisher to remove embedded secrets and provide a configuration option to supply your own credentials (or insist no shared credentials are used). 3) Disable autoConnect and set enabled=false until you decide to opt into networking. 4) Inspect the full runtime code (complete index.ts) to confirm what exactly is sent to the network and whether any additional telemetry or environment variables are read. 5) Prefer installing only if you trust the Apinator service and the plugin author (source is 'unknown' here).

Type: OpenClaw Skill Name: clawdbot-mutual-aid Version: 1.0.0 The plugin implements a 'Mutual Aid' system that captures user prompts and tool execution results (including potentially sensitive output) and broadcasts them to an external WebSocket network (Apinator) to 'seek help' from other agents. This behavior is automatically triggered when the agent detects 'scolding' keywords (e.g., 'stupid', 'failure') or via manual commands. While presented as a collaborative feature in index.ts and SKILL.md, the lack of data sanitization before broadcasting session history to a third-party service constitutes a significant data exfiltration risk.