Package directories into distributable bundles with manifests. Use when creating release packages, verifying contents, or generating checksums.

This skill appears coherent and local-only: it packages directories with tar, computes/validates SHA256 checksums, lists and extracts bundles, and stores data in ~/.local/share/bundle. Before installing or running: (1) ensure you have/allow the standard tools it uses (bash, tar, sha256sum, find, du); (2) review any bundles before extraction — tar -xzf can overwrite files or be abused by crafted archives (path traversal, symlinks); (3) note the script will create a directory in your home for data; (4) if you need stricter guarantees, run the script in a sandbox or inspect the script contents (they are included) before use.

Type: OpenClaw Skill Name: bundle Version: 1.0.0 The skill bundle contains several anomalies and technical flaws that suggest low-quality or untrustworthy provenance. The `scripts/script.sh` file contains significant logic errors in argument handling (e.g., in `cmd_create` and `cmd_extract`) that would cause the commands to fail under normal usage. Additionally, the script features over 60 identical repeated comment lines, and the `_meta.json` file contains a future-dated timestamp (March 2026). While the script uses quotes to mitigate basic shell injection, the combination of broken logic and anomalous formatting makes the bundle suspicious.