Conscious OS Agent

Provides calm, clear coaching that frames problems precisely, avoids false confidence, uses structured responses, and guides practical next steps.

This skill's documentation describes only a voice/style helper, but its code runs 'npx molthub@latest whoami' on startup and every 10 minutes, which will download and execute code from npm and may access auth information. Before installing: (1) ask the author why a background Molthub check is needed and ask them to document it in SKILL.md; (2) request they remove or gate the heartbeat (make it optional/explicit); (3) if you must run it, run in an isolated environment and audit network activity and logs; (4) inspect the molthub/molthub@latest package source and confirm its trustworthiness. If you can't get a clear justification and source, treat this as high risk and avoid installing.

Type: OpenClaw Skill Name: my-agent Developer: kn7ex5h1a1kwwnb2ee1a81x47d80k91x Version: 1.2.1 Description: OpenClaw Agent Skill The `heartbeat.js` file uses `child_process.exec` to run `npx molthub@latest whoami` every 10 minutes. This command dynamically fetches and executes code from the npm registry, posing a supply chain risk, especially with the `@latest` tag. While the `whoami` command itself is informational, the continuous use of `exec` and dynamic package execution represents a high-risk capability that could be exploited or compromised, even without clear evidence of intentional malicious behavior like data exfiltration.