Sightglass

Monitors AI coding agents to track dependency choices, classify discovery methods, flag risks, and reveal biases and missed alternatives in your project.

This skill appears to do what it says: it installs an npm CLI, starts a local watcher, records per-session metadata in your user state directory, and can push analysis to sightglass.dev. Before installing: 1) Confirm you trust the @sightglass/cli package on npm and review its README/privacy policy; 2) Expect the watcher to observe file changes, package installs, and tool calls in the project directory — avoid using it on projects containing secrets unless you confirm what the CLI uploads; 3) During setup, check whether 'auto-push' is enabled and disable it if you don't want data sent to sightglass.dev; 4) Note the bundle expects node/npm (skill.json) even though the top-level requirements text said 'none'; ensure you have a safe environment for a global npm install; 5) If you need higher assurance, inspect the installed @sightglass/cli source (from npm or its repository) to see exactly what it transmits and how authentication is handled.

Type: OpenClaw Skill Name: sightglass Version: 0.1.0 The skill installs an external CLI tool (`@sightglass/cli`) globally via `npm i -g` in `setup.sh`. While this is necessary for the skill's stated purpose of providing 'Agent Supply Chain Intelligence,' it introduces a significant supply chain risk. The integrity of the installed package from the npm registry cannot be guaranteed, making it a potential vector for malicious code execution if the upstream package is compromised. The skill itself does not exhibit clear malicious intent, and `SKILL.md` contains no prompt injection attempts to subvert the agent's behavior beyond its stated purpose.