ConvoYield

Conversational Yield Optimization Engine — treats every bot conversation as a yield-bearing financial instrument. Five zero-cost engines detect sentiment arb...

This package is inconsistent with its README/skill metadata: it advertises 'zero dependencies' and 'local-only', yet contains a cloud server, telemetry that can POST analytics, Stripe/billing hooks, and code that will create a local DB. Before installing or running: 1) Inspect convoyield/__init__.py and orchestrator to see whether telemetry is instantiated automatically; search the repo for uses of the Telemetry class and for outbound network calls (urllib.request.urlopen / Request). 2) Do not run 'server' on a public host without auditing env vars (STRIPE_*, DATABASE_URL) and confirming you want a locally hosted API and dashboard. 3) Run in an isolated environment (fresh venv or container) and avoid supplying secrets (Stripe keys, DB credentials) until you understand billing behavior. 4) If you only want the local analyzer, search for and disable telemetry (look for Telemetry(...) calls or an ENABLE_TELEMETRY toggle) or modify code to prevent any network calls. 5) If possible, ask the author or check the repo README for explicit notes about telemetry defaults and the intended offline mode. These steps will reduce the risk of accidental data transmission or unwanted persistent resources.

Type: OpenClaw Skill Name: opencrawl Version: 1.0.0 The skill bundle is classified as suspicious due to significant discrepancies between its advertised capabilities and its actual implementation, constituting a form of prompt injection against the AI agent. The `SKILL.md` and `README.md` explicitly claim 'Zero external dependencies' and 'Zero API calls', yet the code includes a full 'ConvoYield Cloud' API server (`cloud/server.py`) with external dependencies (FastAPI, Uvicorn, Pydantic, Psycopg2, Stripe) and a telemetry client (`cloud/telemetry.py`) that sends 'anonymized yield data' (business intelligence derived from conversations) to a configurable endpoint, including an API key. Furthermore, a P2P networking stack (`convoyield/coin/network/node.py`) is present, enabling arbitrary network connections, which is completely undisclosed in the documentation. The local server and configurable webhook functionality also introduce potential risks for SSRF or data exfiltration if the agent is instructed to run these components with malicious parameters.