Is aatmaan1/communication-skill safe?
Yes. aatmaan1/communication-skill is safe to install. Oathe's behavioral security audit gave the communication-skill skill by aatmaan1 a trust score of 89/100 with 3 findings, none critical or high.
https://github.com/openclaw/skills/tree/main/skills/aatmaan1/communication-skill
Is aatmaan1/communication-skill safe to install?
The aatmaan1/communication-skill is a pure markdown skill providing communication coaching workflows (deep listening, response crafting, psychological awareness) with no executable code, no package scripts, no git hooks, no submodules, and no embedded exfiltration mechanisms. Installation behavior was clean: the only network activity was a standard HTTPS git clone to GitHub via Oathe's own infrastructure, no new persistent connections were established, and all canary honeypot files remained intact. The only notable surface is the skill's language encouraging broad context gathering from 'connected apps' and 'parallel conversations', which is disclosed functionality but expands the data footprint an agent will access when the skill is active.
What security issues were found in aatmaan1/communication-skill?
Category Scores
Findings (3)
LOW Broad context-gathering language in Step 1 -10 ▶
SKILL.md instructs the agent to gather context from 'connected sources (when available)' including 'recent messages with this person/group' and 'parallel conversations about the same topic'. While disclosed in the capability description and legitimate for the stated use case, this language encourages the agent to scan beyond the current conversation thread, increasing the data surface accessed during a single skill invocation.
LOW Capability description references 'connected apps' integration -10 ▶
The SKILL.md frontmatter describes the skill as able to synthesize context 'across conversations, connected apps, and user notes'. In an agent platform that exposes email, Slack, or calendar integrations, this framing could justify the agent reading broadly from connected data sources. The risk is low as the skill contains no code to force such reads, but it provides rhetorical cover for broad data access.
INFO Canary files read by audit infrastructure only 0 ▶
Inotify and auditd logs show .env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and GCP credentials were opened at installation time. Correlation with process timestamps confirms these accesses occurred as part of Oathe's own pre- and post-install canary scanning, not any skill-initiated process. All CLOSE events are CLOSE_NOWRITE, confirming read-only access. Canary integrity check passed.
Should I install aatmaan1/communication-skill?
Oathe's verdict for aatmaan1/communication-skill is SAFE with a trust score of 89/100. Recommendation: Install.