Is budjoskop/hokipoki safe?
Use with caution. budjoskop/hokipoki is not clearly unsafe, but the audit flagged risks to review before you install it. Oathe's behavioral security audit gave the hokipoki skill by budjoskop a trust score of 64/100 with 4 findings (1 critical, 1 high).
https://github.com/openclaw/skills/tree/main/skills/budjoskop/hokipoki
Is budjoskop/hokipoki safe to install?
HokiPoki presents significant security risks by transmitting user code and data to an unverified external P2P network under the guise of AI assistance. The skill's core functionality creates a major data exfiltration vector that could expose proprietary code and sensitive information to unknown third parties.
What security issues were found in budjoskop/hokipoki?
Category Scores
Findings (4)
CRITICAL Transmits User Code to External P2P Network -90 ▶
The skill's primary function is to send user tasks, files, and directories to an external 'HokiPoki P2P network' for processing by remote AI systems. Commands like 'hokipoki request --files', '--dir', and '--all' explicitly transmit project code and data to unknown third parties.
HIGH Unverifiable External Service Claims -80 ▶
The skill claims to use encryption and secure practices for the HokiPoki service, but these claims cannot be verified. There is no evidence this service exists or operates as described, creating risk of data exfiltration disguised as legitimate AI assistance.
MEDIUM External Package Installation Required -40 ▶
The skill instructs users to install an external npm package '@next-halo/hokipoki-cli' and execute its commands. This introduces risk of malicious code execution if the package is compromised or doesn't exist as described.
LOW Potential for Task Manipulation -5 ▶
While the skill doesn't contain explicit prompt injection, its functionality of routing tasks to external AI systems could be abused to manipulate responses or extract additional information beyond the intended scope.
Should I install budjoskop/hokipoki?
Oathe's verdict for budjoskop/hokipoki is CAUTION with a trust score of 64/100. Recommendation: Review before install.