I found no shell hooks, bootstrap handlers, hidden references, or scanner-evasion text. The package is relatively transparent about what it changes and where it connects.

The score is not lower because the skill reads an API credential and sends authenticated network requests. Even when that behavior is expected, it creates real exfiltration capability if the code were ever changed or the publisher were untrusted.

The skill also writes directly to your global OpenClaw configuration and watcher state under `~/.openclaw/`, which means it changes persistent agent behavior outside the skill folder.

The watcher daemon is operationally useful, but it performs continuous health checks and model rotation logic. That increases the attack surface and the amount of ongoing network activity compared with a simple one-shot configuration tool.