openclaw-installer-deployment

SUSPICIOUS. The skill’s purpose broadly matches its capabilities, but the install and configuration path is not well aligned with OpenClaw’s official distribution: it routes users to a third-party GitHub installer repo, uses multiple mutable curl|bash commands, and requests numerous sensitive API and bot credentials for a service with remote-control abilities. I see no confirmed malware or explicit exfiltration endpoint, but the supply-chain trust and credential-handling footprint are too broad to treat as benign.