MH bear-notes

Create, search, and manage Bear notes via grizzly CLI.

This skill appears coherent, but take these precautions before installing: - Review the grizzly GitHub repo and consider pinning the module to a specific release rather than '@latest' to avoid unexpected upstream changes. - The Bear API token (~/.config/grizzly/token) is sensitive: create it only from the Bear app UI, store it with restrictive file permissions, and do not expose it to remote endpoints. - Be cautious with GRIZZLY_CALLBACK_URL: the callback mechanism is needed to read note contents, but if you configure the callback URL to a remote host it could transmit note data off your machine. Prefer localhost callbacks unless you explicitly need remote delivery. - Verify the built 'grizzly' binary (audit source or checksum) if you care about supply-chain/trust. - This skill is macOS-only and requires the Bear app to be installed and running. If you are comfortable with these trade-offs, the skill's requirements and instructions match its stated purpose.

Type: OpenClaw Skill Name: mh-bear-notes Version: 1.0.0 The skill bundle is designed to manage Bear notes using the `grizzly` CLI tool. The `SKILL.md` clearly outlines its purpose, installation via `go install github.com/tylerwince/grizzly/cmd/grizzly@latest`, and usage instructions. It requires the user to manually provide a Bear API token for certain operations, which is then used by the `grizzly` tool via a specified file path. There is no evidence of prompt injection against the agent, data exfiltration to external endpoints (callback URLs are localhost), malicious execution, persistence mechanisms, or obfuscation. The skill's behavior is entirely aligned with its stated purpose.