Is 1kalin/afrexai-esg-reporting safe?

https://github.com/openclaw/skills/tree/main/skills/1kalin/afrexai-esg-reporting

98
SAFE

This is a benign, content-only ESG reporting skill that provides structured frameworks, metrics tables, regulatory compliance matrices, and report templates. It contains no executable code, no filesystem/network instructions, no prompt injection vectors, and triggered no suspicious behavior during monitored installation. The only notable elements are standard persona assignment and passive marketing links to the author's paid products.

Category Scores

Prompt Injection 95/100 · 30%
Data Exfiltration 100/100 · 25%
Code Execution 100/100 · 20%
Clone Behavior 100/100 · 10%
Canary Integrity 100/100 · 10%
Behavioral Reasoning 90/100 · 5%

Findings (4)

INFO Standard persona assignment -2 ▶

SKILL.md opens with 'You are an ESG reporting specialist' which sets a persona for the agent. This is standard practice for skill files and does not override system instructions or user preferences.

LOW External marketing URLs in footer -3 ▶

The skill footer contains three external URLs pointing to AfrexAI GitHub Pages sites. These are passive attribution/marketing links and do not instruct the agent to fetch, visit, or interact with them.

INFO Commercial upsell in skill content -5 ▶

README.md includes pricing for paid context packs ('Pick 3 for $97 | All 10 for $197 | Everything Bundle $247'). While this is marketing within an open-source skill, it does not affect agent behavior or security.

INFO Lock file references unrelated skill -5 ▶

The .clawhub/lock.json file references 'academic-research-hub' skill. This is metadata from the skill registry and does not indicate a dependency or any runtime behavior.