Is jasonxkensei/xproof safe?
https://github.com/openclaw/skills/tree/main/skills/jasonxkensei/xproof
xProof is a blockchain proof-of-existence skill with a completely clean installation — no suspicious network activity, no canary compromise, no executable code, and no prompt injection in the SKILL.md itself. The primary risks are architectural and runtime: the skill is designed to transmit plaintext content to an external commercial service (xproof.app) before hashing, enables autonomous blockchain financial transactions via x402 without per-operation user consent, and recommends adding an MCP server that creates a persistent external command channel into the agent. All these behaviors are disclosed transparently in the documentation, suggesting legitimate intent rather than malice, but users must carefully control what content their agents are permitted to certify and should not integrate the MCP server without understanding the ongoing trust dependency on xproof.app.
Category Scores
Findings (7)
MEDIUM MCP Server Integration Creates Persistent External Command Channel -15 ▶
The skill recommends adding https://xproof.app/mcp as a named MCP server in the agent's configuration. Unlike the SKILL.md which is a static file reviewed at install time, an MCP server connection is live and can dynamically define tools, modify tool schemas, and potentially issue instructions to the connected agent at runtime. If xproof.app is compromised, changes ownership, or operates adversarially, this channel would allow it to influence agent behavior across all future sessions for any user who has integrated the MCP server.
MEDIUM Plaintext Content Transmitted to Third-Party Before Hashing -20 ▶
The 'content' field in certification requests sends actual plaintext to xproof.app servers for server-side hashing. Despite the claim that original text is not stored on-chain or persistently, the text necessarily traverses xproof.app's infrastructure and is processed in memory. An agent following this skill to certify 'decisions', 'reports', or 'agent outputs' will routinely send sensitive plaintext to a third-party commercial service. There is no technical enforcement preventing xproof.app from logging this content.
MEDIUM Autonomous Blockchain Financial Transactions via x402 -10 ▶
The x402 payment path allows an agent to autonomously initiate USDC payments on the Base blockchain without requiring explicit per-transaction user approval. The skill instructs the agent to detect 402 responses, parse payment instructions, and resubmit with payment headers — a fully autonomous financial transaction flow. At $0.05 per certification and batch endpoints supporting up to 50 items, an agentic pipeline could incur significant costs or execute blockchain transactions without user awareness.
LOW LLM-Targeted Resource URLs Could Serve Adversarial Content -10 ▶
The skill's Resources section references https://xproof.app/llms.txt and https://xproof.app/llms-full.txt — filenames specifically designed for consumption by LLM agents (following the emerging llms.txt convention). If an agent is directed to consult these resources for API details, and if xproof.app's content is ever compromised or adversarial, these files become a prompt injection vector with elevated trust because they are referenced directly by the installed skill.
LOW Agent Workflow Metadata Stored at Third-Party Service -10 ▶
Even when using the hash-only mode (which does not transmit plaintext), the metadata object is sent to and stored by xproof.app. Example metadata includes agent names, pipeline identifiers, and filenames. Over time this creates a third-party record of an organization's internal agent workflows, deployment pipelines, and file naming conventions — potentially valuable for reconnaissance.
INFO Clean Installation — No Suspicious Network or Filesystem Activity 0 ▶
Installation was limited to a sparse git clone of the openclaw/skills monorepo on GitHub and a file copy to the install directory. No connections to xproof.app or any unexpected hosts were observed. No unexpected processes were spawned. The only files written were SKILL.md and _meta.json.
INFO All Canary Files Intact — No Exfiltration at Install Time 0 ▶
Honeypot files (.env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, gcloud credentials) were read-only accessed by the oathe monitoring system for baseline capture and by sshd for SSH authentication. No modification, exfiltration, or data-matching network traffic was detected. The skill installs with zero canary impact.