S2 Mothership [3.22 Native]

A spatial logic framework for Openclaw. Provides local state compression and coordinate management safely isolated in user space.

This package contains many source files that implement local databases, device adapters (Tuya, Home Assistant), LLM calls to localhost, and a vault/backup system — so its behavior broadly matches a home-agent OS. However: 1) metadata inconsistencies (registry says no env vars/binaries, SKILL.md lists several) are red flags — ask the publisher to correct and explain them; 2) do not provide HA_TOKEN/TUYA_SECRET or other secrets until you (or a trusted reviewer) have audited the actuator adapter code paths that use them; 3) verify that the code truly refuses network/cloud calls when credentials are absent (search for unconditional requests.post calls or code paths that fall back to cloud); 4) run the package in an isolated sandbox or VM first (no real home devices, no real tokens) and monitor network traffic and filesystem writes; 5) inspect handler.py and any entrypoint for exec() usage or dynamic code execution, and search files for hidden/control characters or obfuscated strings; 6) the repeated dual-licensing/legal notices are unusual — ensure the license terms meet your intended use (they claim non-commercial only). Given the mismatches and the prompt-injection signal, treat this skill as suspicious until you can confirm the code and runtime behavior.

Type: OpenClaw Skill Name: s2-space-agent-os-mothership Version: 1.1.3 This bundle is a comprehensive framework for spatial management and IoT orchestration. It implements high-risk capabilities such as port scanning for device discovery (universal_scanner.py, s2_vision_projection.py) and system-level network metadata retrieval via 'arp' commands (s2_fortress_boot.py), but these are clearly aligned with its stated purpose as a smart home 'Mothership.' The code demonstrates security awareness through the inclusion of SSRF protections in its hardware adapters (e.g., s2_ha_local_adapter.py) and lacks any indicators of malicious intent, such as data exfiltration or unauthorized persistence.