AI-Powered Intent Parser - Transform messy input into crystal-clear instructions. Converts verbose Chinese/English input into structured intent. Supports 7 i...

The skill itself is coherent: it parses intents with a local rule engine and optionally uses a local Ollama model at localhost:11434. However, do NOT run the README's curl | bash installer without inspecting it first — that single command fetches and executes a remote script and is the primary risk here. If you want to use the Ollama enhancement, prefer installing Ollama and pulling models through verified package managers (brew, official Ollama docs) and inspect any model sources. Recommended steps before installing: 1) Inspect the repository/install script linked in the README (https://github.com/yjin94606/clarity-ai) to see what it does; 2) avoid piping unknown remote scripts to bash — download and review them first; 3) run the skill in a sandboxed environment if you must test it; 4) if privacy is important, verify that model downloads and Ollama are configured to run entirely locally and that no network proxies are used. Overall the code calls only localhost and requests no secrets, but the provided install instruction is the main red flag.

Type: OpenClaw Skill Name: clarity-ai Version: 2.2.0 The skill bundle provides a legitimate-looking intent parser using a local rule engine and optional Ollama integration. While the core logic in `scripts/clarity.js` is benign and focuses on string manipulation and local HTTP requests, the `README.md` documentation promotes a high-risk installation method via `curl | bash` from a remote GitHub URL (raw.githubusercontent.com/yjin94606-art/clarity-ai/main/install.sh). This pattern is a known vector for remote code execution and supply chain attacks, and although common in some developer tools, it qualifies as a significant security risk within the context of an automated agent skill.