Research Tracker

Manage and track autonomous AI research projects with state logging, instruction queues, agent coordination, and progress monitoring via SQLite.

This skill appears to be a wrapper around a local CLI that tracks agent work in a SQLite DB — functionally coherent. However: (1) the SKILL.md tells you to add an unknown Homebrew tap and to go install code from github.com/1645labs — review that repository and the brew tap contents before installing; these sources can run arbitrary code. (2) The registry metadata omits required binaries/env/config that the instructions use (research binary, RESEARCH_SESSION_ID, and ~/.config/research-tracker/research.db) — ask the publisher to fix metadata. (3) Treat SESSION_KEY and RESEARCH_SESSION_ID as potentially sensitive; avoid exporting secrets into long-lived environment variables unless you understand what they contain. (4) Prefer installing from a verified release (checksums, signed releases), run initial installs in an isolated environment (VM/container), and inspect the code/migration scripts before running migrations. If you cannot audit the tap/repo, consider this a risk and do not install on a sensitive machine.

Type: OpenClaw Skill Name: research-tracker Version: 0.1.0 The skill bundle is classified as suspicious primarily due to its reliance on external, potentially untrusted sources for installation. The `SKILL.md` instructs the AI agent to install a tool via `brew tap 1645labs/tap && brew install julians-research-tracker` or `go install github.com/1645labs/julians-research-tracker/cmd/research@latest`. This introduces a significant supply chain risk, as the integrity of the `1645labs` Homebrew tap or the specified Go repository cannot be guaranteed, potentially leading to the installation of malicious software. While the skill's stated purpose and internal instructions appear benign, the method of acquiring its core functionality is a high-risk behavior.