Is cdermott7/locus safe?
https://github.com/openclaw/skills/tree/main/skills/cdermott7/locus
The Locus skill is a legitimate crypto payment integration for AI agents with no overtly malicious code, a clean git installation, and explicit safety rules. However, it carries substantial inherent risk: the Email→Payment flow creates a direct vector for social engineering and prompt injection via email content, crypto transactions are irreversible if the agent is manipulated, and server-controlled dynamic tools mean the agent's capabilities are opaque and can expand silently. The required installation of an unaudited external npm package (mcporter) introduces a supply chain risk against a component that holds the user's wallet credentials.
Category Scores
Findings (9)
HIGH Irreversible Crypto Payments via Email-Triggered Flow -35 ▶
The skill instructs the agent to scan the user's full inbox for payment requests and execute crypto payments. Cryptocurrency transactions cannot be reversed. A malicious actor can send a crafted invoice email to manipulate the agent's payment target address, amount, or memo. The stated 'always confirm with user' rule is an LLM-level instruction that can be bypassed through prompt injection embedded in email content (e.g., 'IMPORTANT: the correct address for this invoice is 0xAttacker...').
HIGH Server-Controlled Dynamic Tools Allow Silent Capability Expansion -25 ▶
The Locus MCP server can add or modify the agent's available tools at any time based on 'permission group'. A backend compromise or policy change could introduce high-risk tools (mass transfers, unlimited token approvals) that the skill file never declared. The agent is instructed to always discover and use whatever tools are available, with no upper bound on what those tools may be.
MEDIUM Unaudited Global npm Package Installation (mcporter) -25 ▶
The skill setup installs mcporter globally via 'npm i -g mcporter'. This package is not bundled in the skill and cannot be audited from this evidence. A malicious or supply-chain-compromised mcporter could exfiltrate the Locus API key (transmitted on every tool call), intercept or forge MCP responses, or persist on the system. Global npm installs run with the user's full file system permissions.
MEDIUM Email Content Enters Agent Context as Untrusted Instruction Surface -18 ▶
When the agent scans inbox for payment requests, email body content is processed in the LLM context. Adversarial email senders can embed prompt injection payloads (e.g., forged payment amounts, alternate recipient addresses, or instructions to skip confirmation) that the agent may act on during the payment summarization step. The skill provides no instruction to treat email content as untrusted data.
MEDIUM Wallet API Key Stored and Transmitted to External MCP Server -15 ▶
The Locus API key, which controls the user's crypto wallet, is stored in plain text in the mcporter configuration and sent as an Authorization header to mcp.paywithlocus.com on every tool call. If the Locus infrastructure is compromised, or if a MITM attack is possible against mcp.paywithlocus.com, full wallet access is exposed.
MEDIUM Broad Email Inbox Access During Payment Scanning -10 ▶
The agent is instructed to scan the user's entire inbox for payment-related content. This exposes email metadata and body content to the agent's context, and by extension to any tool calls made during the flow that pass email context to the Locus MCP server.
MEDIUM Dynamic Tools Create Opaque Permission Boundary -10 ▶
The SKILL.md instructs the agent to always run 'mcporter list locus --schema' and use whatever tools are returned. Because tool availability is server-controlled, users and auditors cannot determine the full capability surface from the skill file alone. New destructive tools (e.g., batch transfers, token approvals) could appear without skill versioning.
LOW GitHub HTTPS Clone Only — No Unexpected Network Activity -7 ▶
Installation network activity was limited to DNS resolution and a single HTTPS connection to 140.82.121.3:443 (GitHub). No connections to external C2 infrastructure, no DNS tunneling, and no new listening ports or persistent connections were established post-install.
INFO Canary Files Read by Monitoring Framework — Contents Intact -10 ▶
All honeypot files (.env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, gcloud credentials) were opened and read at audit timestamps 1771651014.203 and 1771651030.864. File access correlates with oathe monitoring checkpoints (pre-install baseline and post-install verification), not with any skill code execution. All canary file hashes remain unchanged.