MiroFish Predict

MiroFish 群體智能推演引擎。當用戶要求「推演」「預測」「模擬」「如果…會怎樣」時使用。透過 55 個 AI Agent 在模擬社交平台上互動推演未來趨勢。

This skill appears to be what it claims: a multi-agent simulation that needs Docker and an LLM API key. Before installing: 1) Verify the mirofish-cli npm package and its maintainer (inspect the GitHub repo and package contents). 2) Confirm which Docker image(s) the CLI will pull and inspect them (unknown images can run arbitrary code on your machine). 3) Use a scoped or low-privilege LLM API key or local model if possible, and set file permissions on ~/.mirofish/.env. 4) Consider limiting billing/quota on the API key (simulations are token-heavy). If you cannot verify the package or images, treat the runtime as higher risk and avoid supplying high-privilege credentials.

Type: OpenClaw Skill Name: mirofish-predict Version: 1.0.1 The skill acts as a wrapper for an external CLI tool (`mirofish-cli`) and requires high-privilege capabilities, including global NPM installation and Docker execution. While these are plausibly necessary for its stated purpose of running multi-agent simulations, the requirement for sensitive credentials (`LLM_API_KEY`) and the reliance on external binaries from an unverified source (`666ghj/MiroFish`) represent a significant attack surface. No explicit evidence of malicious intent or data exfiltration was found in the provided SKILL.md or _meta.json.