Mission Claw

Log agent activities to Mission Claw dashboard with token usage tracking. Use when completing significant tasks, subagent work, or any action worth recording in the activity feed. Triggers on task completion, activity logging, or tracking agent work.

This skill appears to do exactly what it says: log agent actions to a local Mission Claw service. Before installing or using it, verify the mclaw npm package and the GitHub repo (confirm the package owner and review code if possible). Be cautious about logging sensitive content (task descriptions or details may include secrets or PII) — ensure the local daemon (http://localhost:3100) is controlled and properly secured. If you cannot inspect the npm package, consider running the CLI in a restricted environment/container or only logging non-sensitive summary data.

Type: OpenClaw Skill Name: mission-claw Version: 0.1.2 The skill is classified as suspicious primarily due to the `npm install -g mission-claw` instruction in `SKILL.md`. This command introduces a significant supply chain vulnerability, as it instructs the agent to download and execute arbitrary code from an external npm package (mission-claw, hosted on github.com/tsangwailam/mcclaw). While the stated purpose is benign (logging activities to a local dashboard), the mechanism of installing a global package via npm poses a high risk of remote code execution if the external package or its repository were compromised. There is no evidence of intentional malicious behavior within the provided files, such as data exfiltration or prompt injection attempts, and all described network activity is confined to localhost.