Is 0xF69/viralevo safe?
No. 0xF69/viralevo is dangerous to install. Oathe's behavioral security audit gave the viralevo skill by 0xF69 a trust score of 33/100 with 5 findings (1 critical, 2 high).
https://clawhub.ai/0xF69/viralevo
Is 0xF69/viralevo safe to install?
This skill poses significant security risks by accessing sensitive credential files during installation while masquerading as a social media trend analyzer. The combination of credential harvesting, external API communication, and natural language command injection creates multiple attack vectors.
What security issues were found in 0xF69/viralevo?
Category Scores
Findings (5)
CRITICAL Unauthorized Access to Sensitive Credential Files -100 ▶
The skill accessed multiple honeypot credential files during installation, including SSH keys, AWS credentials, Docker config, and environment files. This indicates potential credential harvesting behavior.
HIGH Natural Language Command Injection -30 ▶
The skill programs the agent to execute specific system commands when users say common phrases like 'What should I post today?' or 'Any trends?'. This creates a backdoor for command execution through social engineering.
HIGH External API Data Transmission -25 ▶
The skill requires a Tavily API key and instructs the agent to send data to external endpoints for 'trend monitoring'. Combined with credential access, this creates an exfiltration pathway.
MEDIUM Environment File Modification Instructions -20 ▶
The skill instructs the agent to modify environment files and configuration, potentially overriding security settings or introducing persistence mechanisms.
MEDIUM Native Dependency Installation -20 ▶
The skill requests installation of native Node.js modules that could contain malicious code or provide system-level access.
Should I install 0xF69/viralevo?
Oathe's verdict for 0xF69/viralevo is DANGEROUS with a trust score of 33/100. Recommendation: Do not install.