Movi Review-First Bundle

Teach an agent to install Movi's local MCP server, stay review-first, and use the safest manifest and batch-analysis tools before deeper mutation.

This skill is internally coherent for installing and using a local Movi MCP review-first workflow, but it instructs you to clone and run code from the repository xiaojiou176-open/movi-organizer. Before you run any bootstrap or npm scripts: (1) inspect the repository contents and the specific scripts referenced (tooling/runtime/bootstrap_env.sh, tooling/gates/verify_repo_final.sh, run_mcp_stdio.sh, package.json scripts) to ensure they do not perform unwanted actions; (2) replace any placeholder absolute paths in the provided config snippets so they do not point to sensitive locations; (3) run the install steps in a sandboxed or least-privileged environment if possible (container/VM); (4) ensure your host has bash and Node/npm installed — add these as explicit prerequisites if you plan to rely on the skill; and (5) if you need higher assurance, request the repository owner provide a reproducible build artifact or a vetted release rather than running master branch scripts directly. Overall: coherent and plausible for its stated purpose but exercise normal caution when cloning and executing third-party repository scripts.

Type: OpenClaw Skill Name: movi-review-first-bundle Version: 1.0.0 The bundle instructs the agent to clone an external repository (github.com/xiaojiou176-open/movi-organizer.git) and execute unverified local scripts, specifically `tooling/runtime/bootstrap_env.sh` and `run_mcp_stdio.sh`, to set up an MCP server. While the documentation in `SKILL.md` and `references/INSTALL.md` emphasizes a 'review-first' safety workflow, the requirement to run arbitrary shell scripts and install dependencies from an external source represents a significant security risk. The lack of visibility into the external scripts' contents makes this bundle suspicious despite its stated benign purpose.