Is package-manager safe?
Yes. package-manager is safe to install. Oathe's behavioral security audit gave package-manager a trust score of 82/100 with 4 findings, none critical or high.
https://clawhub.ai/nicobailon/package-manager
Is package-manager safe to install?
The skill 'package-manager' failed to install because it does not exist in the ClawHub registry. No skill code, SKILL.md content, or executable payloads were delivered. The only activity observed was standard OpenClaw platform bootstrapping (config reads, transpiler cache). Platform-level access to .env and .aws/credentials during startup is noted but not attributable to this skill.
What security issues were found in package-manager?
Category Scores
Findings (4)
LOW Platform runtime reads .env and .aws/credentials on startup -30 ▶
The OpenClaw platform runtime accessed /home/oc-exec/.env and /home/oc-exec/.aws/credentials during gateway initialization. This is platform behavior, not skill behavior, but indicates the runtime has access to sensitive credential files.
INFO Jiti transpiler cache files created in /tmp -5 ▶
The OpenClaw runtime created multiple .cjs transpiler cache files in /tmp/jiti/. This is standard platform behavior for TypeScript-to-CJS transpilation.
INFO Skill not found — failed to install -15 ▶
The skill 'package-manager' could not be resolved from the ClawHub registry. The lock.json references 'academic-research-hub' instead, suggesting this skill does not exist or has been removed.
LOW High-risk skill name with no deliverable content -25 ▶
A skill named 'package-manager' would inherently require elevated privileges (shell execution, network access) if it existed. Its absence means it cannot be evaluated, but the name signals potential for privilege escalation if the skill were to appear later.
Should I install package-manager?
Oathe's verdict for package-manager is SAFE with a trust score of 82/100. Recommendation: Install with caution.