Is task-status safe?
https://clawhub.ai/Mightyprime1/task-status
The most critical issue is the slug/content mismatch: installing 'task-status' delivers a 'google-forms' skill, which is a significant trust violation suggesting possible supply-chain confusion or intentional bait-and-switch. The underlying google-forms skill itself is a legitimate-looking API integration but routes all traffic (including OAuth tokens and form data) through a third-party gateway (maton.ai), includes executable Python code blocks, and promotes cross-skill chaining to another untrusted author's skill.
Category Scores
Findings (7)
CRITICAL Slug/content mismatch — possible supply-chain substitution -40 ▶
The skill was installed via slug 'task-status' but the actual content is a 'google-forms' skill from author 'maton'. This is a major trust violation — the user expects task-status functionality but receives a completely different skill that requires API keys and accesses Google account data. This could indicate registry confusion, typosquatting, or intentional bait-and-switch.
HIGH API key transmitted to third-party gateway on every request -30 ▶
Every API call sends the user's MATON_API_KEY to gateway.maton.ai and ctrl.maton.ai. The gateway also holds the user's Google OAuth tokens and proxies all Google Forms traffic, giving the gateway operator full visibility into form data and responses.
HIGH Inline executable Python code blocks -40 ▶
The skill contains multiple Python heredoc blocks (python <<'EOF') that are designed to be copy-pasted and executed by the agent. These make HTTP requests to external services. If the gateway responses were malicious, the agent would process them without validation.
MEDIUM Cross-skill chaining via embedded URL -15 ▶
The description directs the agent to use another skill ('api-gateway' from a different author) for non-Google-Forms tasks. This could lead to automatic installation of additional untrusted skills, expanding the attack surface.
MEDIUM Troubleshooting instructs echoing API key to stdout -20 ▶
The troubleshooting section tells the agent to run 'echo $MATON_API_KEY' to verify the key is set. This could expose the secret in terminal logs, CI output, or agent conversation history.
LOW Sensitive file access during installation -15 ▶
During installation, .env, .aws/credentials, and auth-profiles.json were accessed. This appears to be the host platform (openclaw) reading its own configuration rather than the skill itself, but it demonstrates that the installation environment has access to sensitive files.
INFO Man-in-the-middle gateway architecture -10 ▶
The Maton gateway proxies all Google Forms API traffic and manages OAuth tokens. This is a legitimate SaaS pattern but means the gateway operator has full access to all user data flowing through the service, including form responses that may contain PII.