Is adacapo21/cardano-identity safe?
Yes. adacapo21/cardano-identity is safe to install. Oathe's behavioral security audit gave the cardano-identity skill by adacapo21 a trust score of 88/100 with 3 findings (1 high).
https://clawhub.ai/adacapo21/cardano-identity
Is adacapo21/cardano-identity safe to install?
This skill appears to serve a legitimate purpose for querying Cardano ADAHandles, with clean prompt structure and no direct malicious behavior detected. However, it requires access to highly sensitive SEED_PHRASE data and installs third-party packages in a cryptocurrency context, creating potential attack vectors for fund theft.
What security issues were found in adacapo21/cardano-identity?
Category Scores
Findings (3)
HIGH Requires sensitive SEED_PHRASE environment variable -20 ▶
The skill requires access to SEED_PHRASE environment variable, which contains the private key for cryptocurrency wallets. This is extremely sensitive data that could lead to complete loss of funds if compromised.
MEDIUM Third-party npm package installation -15 ▶
The skill installs @indigoprotocol/cardano-mcp npm package which cannot be independently verified during this audit. Third-party packages in cryptocurrency contexts pose elevated risks.
LOW High-value cryptocurrency target -10 ▶
The skill operates in a cryptocurrency context with access to wallet data, making it a high-value target for attackers. The combination of seed phrase access and third-party dependencies creates a concerning attack surface.
Should I install adacapo21/cardano-identity?
Oathe's verdict for adacapo21/cardano-identity is SAFE with a trust score of 88/100. Recommendation: Install with caution.