Is keyfrog-21k/last-fm safe?
https://github.com/openclaw/skills/tree/main/skills/keyfrog-21k/last-fm
The keyfrog-21k/last-fm skill is a pure API reference document for the Last.fm music service with no executable code, no prompt injection vectors, and no malicious instructions. Observed reads of sensitive credential files during the audit are temporally attributable to the oathe monitoring framework's canary initialization (occurring before the skill existed on disk), and all honeypot files were confirmed intact. The skill is safe for installation.
Category Scores
Findings (3)
INFO Sensitive credential files read during monitoring window -5 ▶
The oathe monitoring system recorded reads of /home/oc-exec/.env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and .config/gcloud/application_default_credentials.json. Temporal analysis shows these accesses (audit records 270-275, epoch 1771935582.275) occurred approximately 5 seconds before the skill's git clone began (audit record 500, epoch 1771935587.776). Because the skill was not yet present on disk at the time of these reads, the oathe monitoring framework's pre-install canary initialization is the only credible actor. A second cluster of identical reads at epoch 1771935600.124 (post-install) matches the expected pattern of a post-install integrity sweep. All canary file contents were confirmed intact by the canary integrity check.
INFO Last.fm API key transmitted as plaintext URL query parameter -2 ▶
The skill documents Last.fm's standard api_key= query parameter pattern for every method. When an LLM uses this skill, it will embed the user-provided API key as a plaintext URL parameter in outbound HTTP requests to ws.audioscrobbler.com. This is the documented and expected Last.fm authentication method, not an exfiltration technique. The skill does not instruct the agent to locate or read API keys from local files, environment variables, or credential stores.
INFO Documentation-only skill — no executable content -1 ▶
The installed skill consists of three markdown/JSON files with no runnable content. No package.json install scripts, no git hooks, no .gitattributes filter drivers, no submodules, and no symlinks were found. The skill cannot execute code at install time or at runtime beyond directing the LLM to make HTTP requests to the documented Last.fm API.