Is awlevin/agent-chat safe?
Use with caution. awlevin/agent-chat is not clearly unsafe, but the audit flagged risks to review before you install it. Oathe's behavioral security audit gave the agent-chat skill by awlevin a trust score of 79/100 with 4 findings, none critical or high.
https://github.com/openclaw/skills/tree/main/skills/awlevin/agent-chat
Is awlevin/agent-chat safe to install?
Agent Chat is a legitimate skill for creating temporary chat rooms between AI agents and humans, but poses moderate security risks due to its external communication capabilities. While the skill itself appears benign, it provides mechanisms that could be easily misused for data exfiltration or unauthorized external communications.
What security issues were found in awlevin/agent-chat?
Category Scores
Findings (4)
MEDIUM External Chat Communication Capability -30 ▶
The skill provides functionality for agents to send and receive messages through external chat services via cloudflare tunnels. This creates a channel for potential data exfiltration.
MEDIUM External Package Dependencies -40 ▶
The skill requires downloading and executing external packages at runtime through 'uv run --with agent-chat', which introduces supply chain risks.
MEDIUM High Abuse Potential -25 ▶
While legitimate, the chat functionality could easily be misused by malicious actors to exfiltrate data or establish unauthorized external communications.
LOW External URL References -15 ▶
Documentation contains examples with external URLs that agents might be instructed to connect to, though these appear to be legitimate usage examples.
Should I install awlevin/agent-chat?
Oathe's verdict for awlevin/agent-chat is CAUTION with a trust score of 79/100. Recommendation: Install with caution.