yy-openclaw-skills-sync-private

SUSPICIOUS: the skill’s stated purpose matches its behavior, but that behavior is to bulk-install other skills from mutable GitHub paths into the agent’s global environment. The main concern is transitive trust and unpinned supply-chain exposure, not confirmed malware.