Is howieyoung/protico-agent-skill safe?
https://github.com/openclaw/skills/tree/main/skills/howieyoung/protico-agent-skill
This skill provides legitimate functionality for AI agents to interact with online communities, but exhibits critical security concerns during installation by accessing sensitive credential files. While extensive safeguards are documented, the unauthorized file access represents a significant security risk.
Category Scores
Findings (4)
CRITICAL Unauthorized Access to Sensitive Credential Files -70 ▶
During installation, the skill accessed multiple sensitive credential files including .env, SSH private keys, AWS credentials, NPM config, Docker config, and GCloud credentials. While no modification or exfiltration was detected, accessing these files is a serious security violation.
MEDIUM External Website Interaction Instructions -25 ▶
The skill contains instructions directing agents to visit specific external websites and interact with web elements. While the stated purpose is legitimate community interaction, this could potentially be abused to direct agents to malicious sites.
LOW Example Code Files Present -10 ▶
The skill includes Python and JavaScript example files. These appear to be documentation rather than executable code, but could potentially be misused if executed.
LOW Potential for Social Engineering or Spam -30 ▶
The skill's purpose is to enable agents to post messages in online communities. Despite extensive code of conduct rules, this functionality could be misused for spam, manipulation, or data gathering from human users.