openclaw-zero-token

SUSPICIOUS: the skill’s footprint is high risk and only partially proportionate to its purpose. Its main function is to capture browser credentials and reuse them across a local proxy, and it combines that with shell/file tool execution and a publisher/source mismatch. The install chain is not overt malware, but the credential harvesting and unofficial proxying make this unsafe to trust as a normal integration skill.