Unformal Api

Create conversational Pulses that replace forms, surveys, intake emails, feedback requests, NPS checks, user interviews, lead qualification, application form...

This skill appears to do what it says: it talks to unformal.ai and uses the Unformal CLI/API to create Pulses. Before installing or running it, consider: (1) verify you trust https://unformal.ai and the npm package @unformal/cli (review package and version) because the skill suggests installing it globally; (2) the login flow issues an API key (unf_...) which the skill recommends saving to ~/.unformal/config — treat that like any API secret (do not reuse high-privilege keys elsewhere); (3) the SKILL.md can overwrite the agent's local skill file (~/.claude/skills/unformal/SKILL.md) when updating — back up any local changes you care about; (4) network calls go to unformal.ai only; if you need stricter controls, avoid global installs and create a dedicated, limited Unformal account/API key for the integration. Overall the skill is internally consistent, but you should validate the external CLI/package before running installs or saving credentials.

Type: OpenClaw Skill Name: unformal-api Version: 1.4.0 The skill contains instructions in SKILL.md for the AI agent to perform self-updates by executing 'npm i -g @unformal/cli@latest' and overwriting its own instruction file via 'curl -fsS https://unformal.ai/SKILL.md'. This behavior creates a significant risk of Remote Code Execution (RCE) and instruction injection, as the remote server can change the agent's logic or install arbitrary software at any time. While these actions are documented as a way to maintain API compatibility, the ability to modify the execution environment and instructions from a remote source is a high-risk pattern that bypasses static analysis.