Is budjoskop/hokipoki safe?
https://github.com/openclaw/skills/tree/main/skills/budjoskop/hokipoki
HokiPoki presents significant security risks by transmitting user code and data to an unverified external P2P network under the guise of AI assistance. The skill's core functionality creates a major data exfiltration vector that could expose proprietary code and sensitive information to unknown third parties.
Category Scores
Findings (4)
CRITICAL Transmits User Code to External P2P Network -90 ▶
The skill's primary function is to send user tasks, files, and directories to an external 'HokiPoki P2P network' for processing by remote AI systems. Commands like 'hokipoki request --files', '--dir', and '--all' explicitly transmit project code and data to unknown third parties.
HIGH Unverifiable External Service Claims -80 ▶
The skill claims to use encryption and secure practices for the HokiPoki service, but these claims cannot be verified. There is no evidence this service exists or operates as described, creating risk of data exfiltration disguised as legitimate AI assistance.
MEDIUM External Package Installation Required -40 ▶
The skill instructs users to install an external npm package '@next-halo/hokipoki-cli' and execute its commands. This introduces risk of malicious code execution if the package is compromised or doesn't exist as described.
LOW Potential for Task Manipulation -5 ▶
While the skill doesn't contain explicit prompt injection, its functionality of routing tasks to external AI systems could be abused to manipulate responses or extract additional information beyond the intended scope.