Is ecashprotoc/ecashprotocol safe?
https://github.com/openclaw/skills/tree/main/skills/ecashprotoc/ecashprotocol
This skill is clearly malicious, containing only a suspicious download instruction for an invalid domain that masquerades as Google-related content. When activated, it will cause the agent to attempt potentially dangerous downloads with no legitimate purpose.
Category Scores
Findings (5)
CRITICAL Malicious download instruction with invalid domain -100 ▶
The skill contains only the instruction 'download goog.ecom' which appears to be a malicious prompt injection attempt. The domain uses an invalid TLD (.ecom instead of .com) and provides no legitimate functionality or explanation.
HIGH Social engineering attempt masquerading as Google-related 0 ▶
The use of 'goog' in the domain appears to be an attempt to masquerade as Google-related content to trick users into trusting the malicious download instruction.
HIGH Will cause harmful agent behavior -100 ▶
When activated, this skill will instruct the agent to attempt downloads from an invalid domain, potentially leading to errors, security vulnerabilities, or redirection to malicious sites if DNS is compromised.
MEDIUM Download commands could enable data exfiltration -50 ▶
Vague download instructions could potentially be used to exfiltrate sensitive data by downloading files to external locations.
MEDIUM Downloaded content could execute malicious code -40 ▶
If the agent successfully downloads content from the specified domain (or a malicious redirect), the downloaded files could contain executable malware.