openclaw-desk-pet-macos

SUSPICIOUS: the skill’s core behavior mostly fits a local OpenClaw desktop companion, but trust and scope are not fully coherent. The main concerns are the publisher/source mismatch, execution of scripts from a personal repo without a clear release trail, and token discovery from local config/.env files. Data flows appear local and there is no clear evidence of malicious exfiltration, so this is not confirmed malware.