hiclaw-collaborative-agent-os

SUSPICIOUS. The skill’s capabilities broadly match its stated purpose, but it relies on remote-script installers, asks for sensitive API credentials, and introduces transitive trust through community skill loading. The main concern is supply-chain and execution trust rather than confirmed malicious behavior.