OpenFleet

Manage your OpenFleet multi-agent workspace — create tasks, assign agents, trigger pulse cycles, manage automations, and monitor activity. Full bidirectional...

Before installing: 1) Verify the OpenFleet service and npm package are legitimate (check openfleet.sh, GitHub repo, npm package maintainers). 2) Update the skill manifest to list all required binaries (cloudflared, openclaw) or be prepared to run those manually. 3) Avoid running npx with -y/unpinned packages in production — prefer a pinned version or inspect the package contents first. 4) Be cautious about exposing a local gateway via cloudflared: this opens a tunnel from your machine to the Internet — only do this if you trust the remote service and limit network exposure (firewall, ephemeral keys). 5) Use an API key with least privilege, rotate it after testing, and monitor activity. If you want higher confidence, ask the publisher for a pinned package version, the exact npm package name/version they expect, and proof of the GitHub repo that contains the published code.

Type: OpenClaw Skill Name: openfleet Version: 1.0.0 The skill is classified as suspicious due to its reliance on `npx` to execute an external npm package (`@open-fleet/mcp-server`) as described in `SKILL.md`. While the stated purpose is legitimate, this introduces a significant supply chain risk, as the behavior of the external package is not directly controlled or reviewed within this skill bundle. The agent is instructed to execute code from an external source, which could potentially be compromised to exfiltrate the required `OPENFLEET_API_KEY` or perform other unauthorized actions. There are no explicit prompt injection attempts or direct malicious instructions within the provided `SKILL.md`.