Is fcavalcantirj/proactive-amcp safe?
https://github.com/openclaw/skills/tree/main/skills/fcavalcantirj/proactive-amcp
This skill provides legitimate agent backup and recovery functionality but raises security concerns due to its access to sensitive data and external upload capabilities. The skill transparently documents its behavior but transmits agent memories and configuration to third-party IPFS services.
Category Scores
Findings (5)
HIGH External Data Upload to IPFS Networks -40 ▶
The skill uploads agent memories, configuration, and potentially sensitive data to external IPFS networks via Solvr and Pinata services. While claimed to be encrypted, this involves transmitting sensitive agent state to third-party services.
MEDIUM Sensitive Honeypot File Access -30 ▶
During installation, the skill accessed multiple honeypot files designed to detect malicious behavior, including fake SSH keys, AWS credentials, and environment files.
MEDIUM Extensive Scripting and System Access -25 ▶
The skill contains 50+ executable shell and Python scripts that perform network operations, filesystem modifications, and system service management. Creates persistent systemd services and cron jobs.
MEDIUM Prescriptive Agent Behavior Instructions -15 ▶
The skill provides detailed instructions for agent behavior and includes natural language trigger patterns that could influence agent responses beyond the intended skill scope.
LOW High Privilege Functionality with Misuse Potential -25 ▶
While the backup/recovery functionality appears legitimate, the skill's capabilities (data access, external uploads, persistence) could be misused for surveillance or data exfiltration if compromised.