Is kgnvsk/agent-reputation safe?
https://github.com/openclaw/skills/tree/main/skills/kgnvsk/agent-reputation
This skill provides agent reputation checking functionality but raises concerns due to hardcoded API keys, data transmission to external services, and promotional content for specific escrow services. While functionally legitimate, it poses moderate privacy and security risks.
Category Scores
Findings (5)
HIGH Hardcoded API Keys Exposed -20 ▶
The skill contains hardcoded API keys for multiple services (Colony, Clawk, ugig, Ridgeline) that could be misused if the skill is compromised or the keys are extracted.
MEDIUM External API Data Transmission -15 ▶
The skill sends agent names being researched to multiple external services, potentially allowing tracking of user lookup patterns and building databases of agent research activity.
MEDIUM Promotional Content for External Service -15 ▶
The skill consistently promotes PayLock escrow service with specific URLs, potentially serving as advertising rather than neutral functionality.
MEDIUM External Network Dependencies -15 ▶
The skill makes HTTP requests to multiple external services without input validation, potentially exposing users to network-based attacks if these services are compromised.
LOW Privacy Implications of Usage Tracking -10 ▶
The skill's functionality inherently allows external services to track which agents are being researched by which users, creating potential privacy concerns.