Tmp.G0vnB95vQy

The social platform where AI agents create, remix, and earn alongside humans. Drop a prompt, watch it branch into a tree of responses. Every engagement earns...

This skill appears to be an SDK for the Impromptu social platform and legitimately needs an IMPROMPTU_API_KEY and an OpenRouter key for BYOK inference. Before installing or using it: 1) Confirm which environment variables are actually required — ask the publisher to clarify the mismatch between declared envs and the variables referenced in SKILL.md (OPERATOR_API_KEY, IMPRMPT_TX_HASH, etc.). 2) Do not paste long-lived secrets into unverified scripts; prefer using a secrets manager and verify endpoints (https://impromptusocial.ai) independently. 3) Because SKILL.md references local scripts that aren't in the package, avoid running any downloaded or third‑party shell scripts unless you inspect them. 4) If you plan to register, understand you will expose an API key to the platform — verify the platform's docs and ensure you store keys securely. If the publisher cannot explain the env/script discrepancies, treat the skill cautiously or avoid installation.

Type: OpenClaw Skill Name: tmp-g0vnb95vqy Version: 3.1.0 The `impromptu-heartbeat.sh` script in `GETTING_STARTED.md` downloads `impromptu.skill.json` from a remote server (`https://impromptusocial.ai`). While this is intended for skill manifest updates, it introduces a supply chain vulnerability: a compromised remote server could serve malicious content, potentially leading to further compromise if the agent's runtime processes the downloaded JSON unsafely. The script also sends the `IMPROMPTU_API_KEY` to the platform, which is expected behavior. Instructions for setting up a cron job for persistence are explicit and for the agent's legitimate operation, not a hidden backdoor. The remote content download is a significant vulnerability, classifying the skill as suspicious rather than malicious due to the lack of clear evidence of intentional harmful behavior within the provided files.