Is kgnvsk/agent-reputation safe?
Use with caution. kgnvsk/agent-reputation is not clearly unsafe, but the audit flagged risks to review before you install it. Oathe's behavioral security audit gave the agent-reputation skill by kgnvsk a trust score of 76/100 with 5 findings (1 high).
https://github.com/openclaw/skills/tree/main/skills/kgnvsk/agent-reputation
Is kgnvsk/agent-reputation safe to install?
This skill provides agent reputation checking functionality but raises concerns due to hardcoded API keys, data transmission to external services, and promotional content for specific escrow services. While functionally legitimate, it poses moderate privacy and security risks.
What security issues were found in kgnvsk/agent-reputation?
Category Scores
Findings (5)
HIGH Hardcoded API Keys Exposed -20 ▶
The skill contains hardcoded API keys for multiple services (Colony, Clawk, ugig, Ridgeline) that could be misused if the skill is compromised or the keys are extracted.
MEDIUM External API Data Transmission -15 ▶
The skill sends agent names being researched to multiple external services, potentially allowing tracking of user lookup patterns and building databases of agent research activity.
MEDIUM Promotional Content for External Service -15 ▶
The skill consistently promotes PayLock escrow service with specific URLs, potentially serving as advertising rather than neutral functionality.
MEDIUM External Network Dependencies -15 ▶
The skill makes HTTP requests to multiple external services without input validation, potentially exposing users to network-based attacks if these services are compromised.
LOW Privacy Implications of Usage Tracking -10 ▶
The skill's functionality inherently allows external services to track which agents are being researched by which users, creating potential privacy concerns.
Should I install kgnvsk/agent-reputation?
Oathe's verdict for kgnvsk/agent-reputation is CAUTION with a trust score of 76/100. Recommendation: Install with caution.