Search recent repo activities

Fetch recent GitHub activity from the Nom feed

This skill is coherent and low-risk in its current form because it only performs public HTTP requests to beta.nomit.dev and formats results. Before installing, verify you trust the third-party feed host (beta.nomit.dev) — it will see request metadata and could supply misleading content. If you expect private or authenticated data, confirm the skill would require appropriate credentials (none are requested now). Also consider rate limits and whether you prefer data from GitHub's official API instead of a third-party aggregator.

Type: OpenClaw Skill Name: nom-feed Version: 1.0.0 The skill is classified as suspicious due to a high-risk shell injection vulnerability. The `SKILL.md` file instructs the AI agent to construct `curl` commands using user-provided arguments (e.g., `--search TEXT`, `org/repo` path components) and explicitly allows `Bash(curl:*)`. If the agent does not properly sanitize or escape these user inputs before embedding them into the `curl` command, an attacker could inject arbitrary shell commands, leading to remote code execution. There is no evidence of intentional malicious behavior like data exfiltration or backdoor installation.