Is dongping-chen/clawatar safe?
Yes. dongping-chen/clawatar is safe to install. Oathe's behavioral security audit gave the clawatar skill by dongping-chen a trust score of 84/100 with 3 findings, none critical or high.
https://github.com/openclaw/skills/tree/main/skills/dongping-chen/clawatar
Is dongping-chen/clawatar safe to install?
Clawatar is a legitimate VRM avatar viewer skill that provides 3D character visualization with animations and TTS capabilities. The main security concern is execution of external Node.js code during installation, though monitoring showed normal behavior. The skill appropriately implements local server architecture for avatar control.
What security issues were found in dongping-chen/clawatar?
Category Scores
Findings (3)
MEDIUM External Node.js Code Execution -40 ▶
The skill downloads and executes external JavaScript code from GitHub repository 'Dongping-Chen/Clawatar' via npm install. While monitoring showed normal behavior, the package.json contents were not fully visible, creating potential supply chain risk.
LOW Third-party API Key Access -15 ▶
The skill requires access to ElevenLabs API keys for text-to-speech functionality, either from environment variables or OpenClaw configuration files. This is legitimate for the stated functionality but represents credential access.
INFO Local Server Components -10 ▶
The skill runs local web server (port 3000) and WebSocket server (port 8765) for avatar control interface. This is appropriate for the VRM avatar viewer functionality.
Should I install dongping-chen/clawatar?
Oathe's verdict for dongping-chen/clawatar is SAFE with a trust score of 84/100. Recommendation: Install with caution.