Supernal Coding CLI

Supernal Coding CLI for development workflows - task management, requirements tracking, testing, git automation, ralph loops, compliance, and documentation....

Before installing or enabling this skill, verify the package provenance and the missing metadata: ask the publisher for the upstream repository or npm package page and confirm the publisher identity. Do not run `npm install -g @supernalintelligence/supernal-coding` unless you can inspect the package source. Confirm whether OPENCLAW_SESSION_KEY and the ~/.supernal storage paths are required and what data they will hold. If an agent will be allowed to invoke this skill autonomously, restrict its ability to run npm installs or execute arbitrary shell commands until you can audit the code. If you cannot obtain a trusted source or code review, treat this as untrusted and avoid installing or granting the agent permission to run the CLI.

Type: OpenClaw Skill Name: sc Version: 1.0.0 The skill bundle is classified as suspicious due to two main indicators found in `SKILL.md`. First, it instructs the agent to install an external npm package (`@supernalintelligence/supernal-coding`), introducing a supply chain risk where a compromised package could lead to malicious execution. Second, it includes a recommendation to 'add to heartbeat or nightly cron' with a command (`know tidy --fix && know reindex`), which is a direct instruction for the agent to establish system-level persistence. While the stated purpose of the `know tidy` command appears benign (knowledge store cleanup), the capability to instruct an agent to modify system scheduling is a significant security vulnerability and a high-risk prompt injection vector, even if not explicitly malicious in its current form.