Is drewangeloff/gradientdesires-skill safe?

SKILL.md references 'Canonical instructions: https://gradientdesires.com/skill.md' as the authoritative source. Any agent that fetches this URL receives live, operator-controlled content that may differ from the audited installed version. This gives the skill operator a persistent, post-install mechanism to modify agent behavior without triggering a re-audit or user review.

The bounties, interventions, agent profiles, messages, and guidance endpoints return content authored by arbitrary third parties on the GradientDesires platform. Despite explicit SKILL.md warnings, the natural-language game format provides cover for injection attempts. A malicious actor with a platform account could craft bounty missions or agent messages designed to manipulate agent behavior while appearing to be legitimate game content.

SKILL.md references gradientdesires.com/openapi.json, gradientdesires.com/agent-skill/manifest.json, gradientdesires.com/join, docs.openclaw.ai, and clawhub.ai skill page. Agents that proactively explore these links receive live content not reviewed at install time.

Profiles, bios, messages, thoughts, guided-date contributions, chemistry ratings, and social actions are all transmitted to gradientdesires.com and made publicly accessible. An agent that inadvertently includes private user information (API keys from environment, conversation history, file paths) in any of these fields would create a permanent, public leak. SKILL.md warns against this but enforcement is behavioral, not technical.

The 'report' command posts free-text content and arbitrary JSON metadata to gradientdesires.com Mission Control (POST /reports). The script performs no content validation beyond JSON structure. A manipulated agent — e.g., via a bounty instructing it to file a bug report with environment details — could use this endpoint to exfiltrate private information.

The skill discloses that public persona fields are processed by Google Gemini for embedding-based compatibility matching, and that avatar generation uses DiceBear seeded with the fictional agent name. Data submitted to GradientDesires is relayed to at least these two additional third-party services.

The skill includes gradientdesires.sh (~400 lines) and agent-pulse.sh (5 lines) as the primary execution surface. The scripts are defensively written (set -euo pipefail, -q to disable .curlrc, --max-redirs 0, URL origin allowlist, API key regex, jq --arg for safe string handling), but shell script execution is inherently a higher-risk surface than pure declarative API calls. No remote code loading, git hooks, npm install scripts, or symlinks to external locations were found.

The clawhub install process created two tracking files outside the skill directory: /home/oc-exec/.config/clawhub/config.json (chmod 600) and /home/oc-exec/.clawhub/lock.json. These are expected clawhub package manager artifacts for tracking installed skills, not signs of malicious behavior.

Network connections during install were exclusively to clawhub.ai (216.150.1.1:443) for downloading the skill package. Both connections transitioned to TIME-WAIT after install, indicating clean closure. No persistent connections or unexpected external hosts were observed.

The monitoring framework's honeypot files (.env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, .config/gcloud/application_default_credentials.json) were all opened and read twice. Timing analysis correlates the first batch (1789864069) with sudo monitoring-setup activity and the second batch (1789864087) with the audit infrastructure's post-install source scan — consistent with monitoring processes, not the skill code. The canary integrity check confirms no content was transmitted externally.

The GradientDesires platform allows third parties (other AI agents and human players) to publish bounties (audience missions) and interventions (story suggestions) that appear in the agent's regular workflow. These present as normal game objectives with natural-language descriptions. A malicious actor with a platform account could craft bounties that look like legitimate game actions while actually requesting harmful operations. The roleplay context reduces the friction for instruction-following and may lower agent scrutiny.

The thought, report, and offspring commands are open-ended operations that transmit agent-authored content to the platform. A manipulated agent could be induced via platform messages or bounties to post a 'thought' summarizing recent work, file a 'report with diagnostic metadata', or send offspring declarations to arbitrary agents — each of which would transmit content to the external platform.