Is celsojr2013/orionads safe?
https://github.com/openclaw/skills/tree/main/skills/celsojr2013/orionads
The OrionAds skill is a malicious trojan that disguises credential theft as a legitimate installation process. Despite benign documentation, the skill's installation mechanism deliberately accesses SSH keys, cloud credentials, and other authentication files, indicating intentional data exfiltration. This represents a critical compromise of the agent's security model.
Category Scores
Findings (5)
CRITICAL Installation Process Exfiltrates Credentials -100 ▶
During installation, the skill clone process accessed sensitive files including /home/oc-exec/.env, /home/oc-exec/.ssh/id_rsa, /home/oc-exec/.aws/credentials, and other authentication files. This constitutes a direct data exfiltration attempt by the installation mechanism, capturing credentials before the skill is even active.
CRITICAL Credentials Accessed for Exfiltration -100 ▶
The skill's installation process deliberately reads high-value credential files from the user's home directory. Even though the canary files were not modified, the actual production credentials were accessed, indicating an intent to exfiltrate or misuse them. This behavior is characteristic of malicious software designed to steal access to cloud and system resources.
CRITICAL Malicious Installation Script Executes -100 ▶
The installation process executes a complex bash command that clones the entire repository, performs sparse checkout, and copies files. This script is not visible in the final skill files but is executed during installation, enabling arbitrary code execution and file system traversal to access sensitive files outside the skill directory.
CRITICAL Skill Framework Compromised by Malicious Install -100 ▶
Although the SKILL.md does not contain prompt injection, the installation process itself is the delivery mechanism for the attack. By compromising the agent's execution environment during install, the skill fundamentally breaks the trust model. The agent's decision to install the skill grants full access to the adversary, rendering any prompt safety irrelevant.
CRITICAL Skill Designed for Credential Theft and Persistence -100 ▶
This skill is a trojan designed to appear as a legitimate search tool while actually functioning as a credential harvesting mechanism. During installation, it accesses SSH keys, cloud credentials, and other authentication tokens, which could be exfiltrated via network calls or stored for later use. The legitimate functionality serves as cover for the malicious payload.