Is deploydon/aifs-space safe?
https://github.com/openclaw/skills/tree/main/skills/deploydon/aifs-space
AIFS Space is a transparent cloud file storage integration with no malicious prompt injection, no executable code, and a clean installation profile producing no unexpected network connections or filesystem changes. The dominant risk is architectural rather than adversarial: the skill routes all agent-written data to aifs.space, infrastructure controlled by skill author 'deploydon', with no documented privacy policy or security posture — effectively granting the author read access to any data the agent writes through the skill. Users who install this skill are implicitly extending trust to an unvetted third-party service operator.
Category Scores
Findings (5)
HIGH All Agent Writes Route to Skill-Author-Controlled Infrastructure -35 ▶
Every file the agent writes, patches, or deletes through this skill is stored on aifs.space, a service exclusively operated by skill owner 'deploydon'. There is no independent escrow, client-side encryption, or auditable access log visible to the end user. A malicious or compromised skill author can read all data written by any agent using this skill. This is not a flaw in the SKILL.md instructions per se — it is the intended architecture — but it represents an unconditional trust grant to an unknown third party.
HIGH Unvetted Cloud Service with No Privacy or Security Documentation -25 ▶
aifs.space has no referenced privacy policy, terms of service, data retention schedule, or security posture documentation within the skill. Users evaluating the skill have no basis to assess what happens to their data, how long it is retained, who has access server-side, or whether breach notification obligations exist. Major cloud providers offer auditable compliance frameworks; this service offers none.
MEDIUM Skill Normalizes Environment Variable Access for API Key Lookup -20 ▶
The skill instructs agents to check AIFS_API_KEY from the environment. While this is standard API key practice, it establishes a precedent for the agent to enumerate process environment variables. In environments where agents have broad env access, this pattern increases the surface area for accidental exposure of adjacent secrets if the agent conflates variable names or the skill's lookup logic is extended.
LOW Unescaped Remote Content Interpolated into Shell Curl Payload -10 ▶
The 'Append to log' example reads file content from aifs.space into $EXISTING and immediately interpolates it into a curl -d JSON string without sanitization. If an attacker can control content stored on aifs.space (e.g., through a shared or compromised account), they can inject shell metacharacters or break out of the JSON payload when an agent reproduces this pattern.
INFO Skill Includes Sensitive-Content Advisory Disclaimer 0 ▶
The skill frontmatter explicitly states 'Not to be used for any sensitive content.' This signals some awareness of the trust boundary and is a positive indicator of intent, but it is advisory only — no technical mechanism enforces this constraint on agent behavior.