Threat Intel Aggregator

Aggregates and analyzes threat intelligence data to check targets against known threats and security risks.

This skill looks like documentation for a hosted threat-intel API but omits critical operational details. Before installing or using it: 1) Ask the publisher for the exact base URL(s) and the required authentication method (API key, token, OAuth) and verify the provider's identity and reputation. 2) Do not send real internal IPs, domain names, or sensitive indicators until you confirm where data will be sent, how it's stored, and what privacy/retention policies apply. 3) If the integration requires API keys, ensure keys will be scoped and stored only in secure platform credential storage (and that the skill declares the env var names). 4) Prefer skills that include a servers field in their OpenAPI and explicitly declare required credentials; absent that, treat this skill as untrusted and test only with non-sensitive samples. If the publisher provides those clarifications (server URL, auth, privacy/processing rules, and expected request/response behavior), this assessment could be revised to benign.

Type: OpenClaw Skill Name: threat-intel-aggregator Version: 1.0.0 The bundle defines a legitimate threat intelligence aggregation tool designed to check indicators (IPs, domains, hashes) against security databases. The SKILL.md and openapi.json files describe a standard REST API interface (api.mkkpro.com) without any evidence of malicious instructions, data exfiltration, or unauthorized execution patterns.