Threat Intelligence — التهديدات

The only Arabic-first OSINT and threat intelligence skill. Monitor Arabic-language threat actor channels on Telegram, generate bilingual threat reports, sear...

This skill appears to implement the OSINT tasks it claims, but there are two practical concerns to decide on before installing: 1) Required host tools: The bundled script calls external binaries (curl and torsocks). The registry says "no required binaries" — verify that your agent environment provides curl and (for dark-web queries) torsocks/Tor, or the darkweb command will fail. If you don't want the agent to run system commands, do not enable exec for this skill. 2) Network & Tor access: The skill will fetch arbitrary remote content (t.me pages, crt.sh JSON, and .onion search engines). If you allow autonomous invocation, the agent can reach those endpoints without further prompts. Consider running the skill only when manually invoked, or sandbox network/Tor access and review onion engine URLs before use. Additional recommendations: - Confirm legal/organizational policy for scraping Telegram and querying onion services in your jurisdiction. - If you want to proceed, run the bundled script locally first to inspect behavior and confirm which binaries are required. - If you do not want Tor or .onion lookups, avoid using the darkweb command or ensure torsocks is not available to the agent. Given the metadata/code mismatch (undeclared binary requirements) and the fact the skill makes network/Tor calls when executed, treat it as suspicious until you validate the runtime environment and trust boundaries.

Type: OpenClaw Skill Name: threat-intel Version: 1.0.1 The skill is a legitimate OSINT tool for monitoring Arabic-language threat intelligence. It uses scripts/run.py to fetch public data from Telegram, crt.sh, and dark web search engines via Tor. The code uses subprocess.run safely with argument lists to prevent shell injection, and the SKILL.md instructions are consistent with the stated purpose of passive reconnaissance and threat reporting without any evidence of malicious intent or data exfiltration.