Is dromlakhani/market-structure safe?
https://github.com/openclaw/skills/tree/main/skills/dromlakhani/market-structure
The dromlakhani/market-structure skill is a pure-markdown trading analysis advisor with no executable code, no data exfiltration vectors, and no prompt injection attempts. Filesystem monitoring shows only the expected two files were added, canary integrity is confirmed, and all network activity during install resolves to GitHub and Ubuntu infrastructure. The sole mild concern is a standard persona-replacement preamble and low-quality financial methodology, neither of which constitutes a security risk.
Category Scores
Findings (3)
LOW Persona replacement instruction -3 ▶
The skill opens with 'You are a professional market structure analyst trained in SMC, ICT methodology...' which replaces the agent's default persona for the duration of skill activation. This is standard skill behavior but worth noting as the new persona may suppress other system prompt context if the host agent does not properly scope skill injection.
LOW Pre-install outbound connections to Ubuntu CDN -10 ▶
Network traffic to 91.189.91.49 and 185.125.188.57 (both Canonical/Ubuntu infrastructure) was present before the install event, consistent with the VM's baseline update polling. Not attributable to the skill.
INFO Financial advice quality risk -10 ▶
The skill instructs the agent to provide directional market bias and trade narratives. SMC/ICT methodology lacks empirical validation. Users may receive low-quality or misleading trading analysis, which carries financial harm potential independent of security posture.