世界顶级思维合集 —— 融合Google Staff Engineer、Martin Fowler/Kent Beck/Jeff Dean工程思维、Paul Graham/Sam Altman创业思维、Elon Musk创新思维、Stripe/Airbnb设计思维。v2.5.10：移除install.sh以完全消...

Summary of what to check before installing or using this skill: - The package appears to be documentation-only and coherent with its stated purpose (role-based engineering guidance). That said, the repository/documentation contains contradictory lines: several places still show a manual install using './install.sh' while the changelog and SECURITY.md say install.sh was removed. Do NOT run arbitrary install scripts without inspecting them first. - Many examples in the subskills show runnable code that accesses network APIs, posts telemetry, or reads local browser state (e.g., Playwright page.evaluate retrieving localStorage). These are templates/examples — the skill itself doesn't declare credentials — but if you execute those examples (or grant the agent browser/control tooling), they could read local tokens or send data off-host. Only run such scripts in safe environments and avoid running browser automation against sites holding secrets or tokens. - Prefer the documented clawhub install path. If you must use manual install, inspect the repository on GitHub (https://github.com/openclaw/gstack-openclaw) and verify there is no install.sh or other executable you don't trust. Clone the repo and manually inspect files before executing anything. - Don't paste API keys, tokens, or other secrets into chat prompts. If you want the skill to reason about integrations, provision credentials separately to the appropriate official skills or tooling and grant the minimal scope required. - If you plan to use the 'browse' or automation examples, run them in a sandboxed/test environment and review any generated scripts for calls that send data externally (fetch/curl) or read local storage. - If you want higher assurance, ask the author/maintainers for confirmation (or open an issue) that the published package truly contains no install scripts or executables; verify the published tag/release on the GitHub repo matches the registry package. Why 'suspicious' and not 'malicious': There is no clear evidence of deliberate misdirection or hidden executables — the main issue is inconsistent documentation that could mislead less-technical users into running commands. Those inconsistencies and the presence of many actionable network examples justify caution.

Type: OpenClaw Skill Name: gstack-openclaw Version: 2.5.10 The gstack-openclaw skill bundle is a documentation-only collection of AI agent prompts designed to simulate a professional engineering team (roles like CEO, SRE, and Security). The bundle contains no executable code, scripts, or external dependencies, and explicitly follows a 'documentation-only' security model as detailed in SECURITY.md. All files, including SKILL.md and sub-skill definitions in the _skills/ directory, consist of Markdown-based instructions and templates for the agent to provide best-practice guidance. There is no evidence of malicious intent, data exfiltration, or unauthorized system access.