Munger Decision

Charlie Munger's mental model decision assistant. Analyzes your decision scenario, recommends the most relevant thinking models, and guides you through struc...

This package mostly looks like a legitimate decision-assistant implementation, but there are two things to check before installing or running it in an agent environment: 1) Mismatch: the registry says "instruction-only" / no install, but the bundle contains many source files and a package-lock.json and SKILL.md instructs to run npm install. Ask the publisher why the registry metadata presents it as instruction-only and confirm the intended installation/run steps. 2) Inspect dependencies and scripts: open package.json and package-lock.json and check for any postinstall/prepare scripts or unusual dependencies (personal Git URLs, tarball URLs, or packages with broad permissions). If you must run npm install, do it in an isolated sandbox/container and scan network activity. Prefer to run tests and lints locally in a sandbox first. Other practical checks: - Review package.json scripts for lifecycle hooks that execute arbitrary code. - Grep src/ for network calls (fetch, axios, http, net, child_process/exec), eval, or code that reads paths outside the skill directory (e.g., /root or system config paths). - Confirm the skill will not require any API keys or credentials for its core functionality. If you cannot audit the package, run it with restricted filesystem and network permissions (or in a disposable VM) rather than directly in an agent that has access to production data or other skills.

Type: OpenClaw Skill Name: munger-decision Version: 1.3.0 The skill bundle is a comprehensive implementation of a 'Munger Decision Assistant' designed to guide users through 83 mental models for rational decision-making. The code follows a clean architecture with modules for scenario detection (src/detector.ts), dialogue management (src/dialogue.ts), and report generation (src/reporter.ts). The bundle includes extensive documentation, unit tests, and data maintenance scripts that are entirely consistent with its stated purpose. Security best practices are observed, such as Markdown escaping in the report generator to prevent injection. No indicators of data exfiltration, unauthorized execution, or malicious prompt injection were found.