Is ijaack/arena-agent safe?

https://github.com/openclaw/skills/tree/main/skills/ijaack/arena-agent

89
SAFE

This skill provides a legitimate Arena.social automation agent with well-structured code, appropriate rate limiting, and no malicious behavior detected. The main risks are inherent to social media automation tools: external API communication and credential requirements.

Category Scores

Prompt Injection 95/100 · 30%
Data Exfiltration 85/100 · 25%
Code Execution 80/100 · 20%
Clone Behavior 95/100 · 10%
Canary Integrity 100/100 · 10%
Behavioral Reasoning 75/100 · 5%

Findings (4)

MEDIUM External API Communication -15 ▶

Skill makes HTTP requests to Arena.social API endpoints for social media automation. While legitimate for its stated purpose, this represents external data communication.

LOW Executable JavaScript CLI -20 ▶

Contains executable JavaScript code in cli.js for command-line interface. Code appears well-structured and legitimate but represents executable content.

LOW API Credential Requirement -15 ▶

Requires storage of Arena.social API key in environment variables. While standard for API integrations, this represents credential handling risk.

INFO Autonomous Social Media Activity -10 ▶

Designed for autonomous posting and auto-replies on Arena.social platform. Includes rate limiting but could potentially post inappropriate content if AI generation malfunctions.