me.txt

Create, fetch, and validate me.txt personal identity files for AI agents

This skill is internally coherent and does not ask for secrets or unusual system access. Things to consider before installing or using it: (1) The SKILL.md recommends using 'npx create-me-txt' — running npx will download and execute a package from the npm registry, so verify the CLI package's source before running it. (2) The skill fetches public URLs and a metxt.org lookup API to find me.txt files — ensure you trust that directory service before relying on it. (3) me.txt files are publicly served content; avoid including sensitive personal data (unobfuscated emails, private tokens, or private contact details) in a me.txt you host. (4) If you prefer no remote code execution, you can manually create the me.txt per the provided template instead of running npx. (5) Because the skill can cause network fetches, be mindful about automated/unsupervised invocation: autonomous invocation is allowed by default but here it would only perform public lookups and generation steps. Overall this skill appears benign and appropriate for its stated purpose.

Type: OpenClaw Skill Name: me-txt Version: 1.0.0 The skill instructs the AI agent to execute external commands using `npx create-me-txt` in `SKILL.md`. While the stated purpose of creating, fetching, and validating `me.txt` files appears benign, relying on `npx` to download and run arbitrary code from the npm registry introduces a significant supply chain vulnerability. This allows for potential remote code execution (RCE) if the `create-me-txt` package (or a typosquatted version) were to become malicious, making it a high-risk capability without direct evidence of intentional malice.