A Proxmox-native orchestration skill that turns any home lab into a Self-Healing AI Swarm.

This package is inconsistent and risky. Before installing or running it: 1) Don't run provision.sh on any production or unsandboxed machine — it runs 'curl | sh' installers and modifies system groups. 2) Ask the author for a homepage/source repo and a clear explanation of why Proxmox tokens are required; the included scripts don't use them. 3) If you still want to test it, run it in an isolated VM or throwaway lab network, audit the 'openclaw' npm package source, and remove or replace remote-install lines with explicit, reviewed package installs. 4) Be cautious about allowing the agent to autonomously invoke these tools, since the skill performs local network scans and could cause unexpected outbound connections or system changes.

Type: OpenClaw Skill Name: hydra-evolver Version: 1.0.0 The skill bundle is classified as suspicious due to several high-risk capabilities and practices, despite aligning with its stated purpose of an 'orchestration skill' for a 'Self-Healing AI Swarm'. The `scripts/provision.sh` file uses `curl | sh` for installing Docker, Volta (Node.js), and Tailscale from external domains, which is a high-risk supply chain practice. This script also adds the user to the `docker` group, granting root-equivalent privileges. Additionally, `scripts/scan.py` performs network scanning on a hardcoded private IP range, and `SKILL.md` declares the need for Proxmox API tokens (`PVE_TOKEN_ID`, `PVE_TOKEN_SECRET`) and describes 'Node Injection' and 'VM management', indicating powerful system and network control. While these actions are consistent with the skill's description, they involve significant system modification, network interaction, and reliance on external scripts, posing inherent security risks without clear malicious intent.