Starwars

CLI for AI agents to lookup Star Wars universe info for their humans. Uses SWAPI. No auth required.

This skill claims to be a simple SWAPI CLI and does not request secrets, which is good — but the package does not include the 'starwars' script the instructions reference. Before installing or running anything: (1) verify the actual CLI source (follow the README's GitHub link and inspect scripts/starwars or official releases); (2) do not symlink or install any script into /usr/local/bin until you have reviewed its contents and network behavior; (3) prefer downloading releases from the repository's official releases page (avoid pastebins or unverified URLs); (4) if you let an agent invoke the skill autonomously, ensure you trust it to fetch/install code or restrict it to use only an already-reviewed binary; and (5) check that the script only calls swapi.dev (or other expected hosts) and does not phone home to unexpected endpoints. If the author can provide the script source inline in the package or a signed release URL, that would resolve the main concern.

Type: OpenClaw Skill Name: starwars Version: 1.0.0 The skill bundle is benign. Its stated purpose is to query Star Wars data from SWAPI, which is consistent across all documentation. The `SKILL.md` instructions for the AI agent are specific and limited to calling the `starwars` script with predefined subcommands and arguments, showing no signs of prompt injection. The required binaries (`bash`, `curl`, `jq`) are appropriate for interacting with a REST API, and there is no evidence of data exfiltration, malicious execution, persistence, or obfuscation.