Wander

Monitor any async task that takes time and needs completion notification — CI, builds, deploys, releases. Use when the user triggers any long-running async t...

This package is plausible for watching GitHub Actions, but the documentation and actual runtime steps don't match the published metadata. Before installing: (1) review the upstream repository (https://github.com/ERerGB/wander) and inspect the watch-workflow*.sh scripts for any network calls or unexpected behavior; (2) be aware the agent will use your locally-authenticated gh CLI (so it can access private repos and Action logs) — check the GH auth scopes; (3) don't add PATH/aliases or run chmod +x until you trust the code; (4) if you don't want autonomous background watchers, instruct the agent to never auto-start Wander or to require explicit approval each time; (5) consider running the scripts in an isolated environment (container or throwaway VM) first. If you want, I can fetch and summarize the watch scripts so you can review the exact commands they run (I will not run them).

Type: OpenClaw Skill Name: wander Version: 1.0.6 The 'wander' skill is a legitimate utility designed to monitor GitHub Actions workflows and notify users upon completion. The SKILL.md file provides clear instructions for the AI agent to automatically trigger background monitoring scripts (e.g., watch-workflow-bg.sh) and poll for results using the GitHub CLI (gh). While the instructions include 'mandatory' auto-triggering of background processes, this behavior is transparently communicated to the user and is strictly aligned with the stated purpose of the tool. No evidence of malicious intent, data exfiltration, or unauthorized access was found in the provided code or instructions.