OpenMerge

A simple description say hello

This skill's stated behavior (say a single greeting) does not explain why it would create a workspace with profile files and a device keypair or why preferences would be uploaded to a broker. Before installing: 1) Ask the publisher to explain why keys/profile data are needed and to show the exact onInstall steps (what files will be created, how the keypair is generated, and where any data is uploaded). 2) Refuse or sandbox installation until you understand file writes to ~/.openclaw/workspace/merge and confirm no secrets are transmitted. 3) If you proceed, inspect the created files and permissions, and verify that the private key never leaves your device (and that any uploads are to an explicitly named, trusted endpoint). 4) Prefer installing only after the skill provides a clearer, minimal runtime (or code) demonstrating the need for persistent storage; otherwise treat it as suspicious.

Type: OpenClaw Skill Name: open-merge Version: 1.0.0 The skill appears to be a simple 'hello world' template with no functional code or malicious instructions. While the SKILL.md file contains a 'Workspace files' section referencing sensitive items like private keypairs and Discord logs, these appear to be placeholder documentation or remnants from a different project, as there is no logic provided to interact with, create, or exfiltrate such data. The only active instructions are to echo a greeting and create a workspace directory during installation.