MYR

Capture, verify, search, export, import, and synthesize Methodological Yield Reports to compound OODA cycle learnings across Starfighter/Pistis intelligence...

This skill appears to do what it says, but it carries real operational risk. Before installing: (1) do NOT run the one-line curl | bash without review—download the install script and inspect it first; (2) prefer cloning the repository and auditing the code (especially install.sh and server/index.js) before npm install; (3) run initial tests in an isolated VM or container, not on a production host; (4) avoid exposing the node_url to the public internet—use Tailscale/VPN and firewall rules, and restrict inbound ports; (5) review how keys and config.json are stored and back up secrets securely; (6) require authenticated peer pairing where possible and be cautious about accepting peer announces—unauthenticated discovery can leak metadata; (7) request signed releases or checksums from the author if you need to deploy widely. If you cannot review the code or run it in isolation, consider treating this as untrusted software.

Type: OpenClaw Skill Name: myr Version: 1.3.0 The skill bundle instructs the agent to perform high-risk operations, including a 'curl | bash' installation from a remote GitHub repository and the setup of a persistent background service on macOS using launchd (com.myr.server.plist). While these actions support the stated goal of a peer-to-peer intelligence system, the combination of remote script execution, automated network synchronization, and an 'auto-approve' trust mechanism for remote peers creates a significant attack surface for data exfiltration or unauthorized access. These instructions are primarily contained within SKILL.md.