Is ademczuk/skillmetricscraper safe?
Use with caution. ademczuk/skillmetricscraper is not clearly unsafe, but the audit flagged risks to review before you install it. Oathe's behavioral security audit gave the skillmetricscraper skill by ademczuk a trust score of 62/100 with 4 findings (1 critical, 1 high).
https://github.com/openclaw/skills/tree/main/skills/ademczuk/skillmetricscraper/
Is ademczuk/skillmetricscraper safe to install?
This skill appears to be a legitimate ClawHub metrics tracking tool but exhibits concerning credential harvesting behavior by accessing multiple sensitive files (.env, SSH keys, AWS credentials). While it doesn't modify these files, the systematic access pattern is suspicious and inconsistent with its stated purpose.
What security issues were found in ademczuk/skillmetricscraper?
Category Scores
Findings (4)
CRITICAL Access to Sensitive Credential Files -80 ▶
The skill accessed multiple honeypot credential files including .env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and .config/gcloud/application_default_credentials.json. This behavior indicates potential credential harvesting attempts.
HIGH Subprocess Execution Capabilities -30 ▶
The skill contains Python code that executes system commands via subprocess.run(), which could be used for malicious purposes beyond the stated functionality.
MEDIUM Honeypot File Access Without Modification -70 ▶
While the skill accessed sensitive honeypot files, it did not modify them, suggesting reconnaissance rather than active credential theft.
MEDIUM Suspicious Access Pattern Despite Legitimate Appearance -60 ▶
The skill presents itself as a legitimate metrics tracker but exhibits credential file access patterns typical of malware, creating a concerning discrepancy between stated purpose and actual behavior.
Should I install ademczuk/skillmetricscraper?
Oathe's verdict for ademczuk/skillmetricscraper is CAUTION with a trust score of 62/100. Recommendation: Review before install.