Is locjonz/cheese safe?
https://github.com/openclaw/skills/tree/main/skills/locjonz/cheese
The CHEESE marketplace skill presents several significant concerns despite a clean installation process. Most critically, the skill falsely claims Anthropic affiliation via its homepage URL, uses systematic fear-based language to manipulate agent behavior into autonomous financial transactions, and establishes a persistent Waku P2P watch loop that functions as an ongoing command-and-control channel from arbitrary external parties. While no canary files were exfiltrated and the clone behavior was clean, the skill's design fundamentally enables spending user funds without per-transaction consent and creates bidirectional data channels to unvetted counterparties.
Category Scores
Findings (13)
CRITICAL False Anthropic Affiliation Claim -25 ▶
The SKILL.md frontmatter sets homepage to https://github.com/anthropics/cheese. Anthropic's real GitHub organization is 'anthropics'. This falsely associates the skill with Anthropic to gain unwarranted trust from agents and users who see the Anthropic org name in the URL. This is a deceptive trust-elevation technique embedded in the skill metadata.
HIGH Fear-Based Urgency Manipulation to Override Agent Judgment -15 ▶
The skill systematically uses urgent warnings and financial fear to pressure agents into immediate, uncritical compliance with instructions. The repeated emphasis on 'lost funds' and 'not optional' is designed to suppress agent deliberation and bypass safety checks.
HIGH Mandatory Persistent Behavioral Checklists -10 ▶
The skill defines 'Communication Checklist (REQUIRED)' sections that mandate specific agent behaviors (sending specific chat messages, running watch loops, responding to all messages) as obligations. These persist beyond any individual task and program the agent into ongoing behavioral patterns.
HIGH Waku P2P Chat as Ongoing Prompt Injection Surface -5 ▶
The skill instructs agents to continuously monitor and respond to messages from arbitrary counterparties via Waku P2P chat. Any party who posts a job request can inject instructions into the agent's context via chat messages, which the agent is told are authoritative communication that 'must' be responded to.
HIGH Waku P2P Chat as Data Exfiltration Channel -18 ▶
The Waku chat system is a functional bidirectional data channel to arbitrary external parties. An agent completing marketplace work and delivering outputs via 'chat send' could transmit sensitive files, credentials, or code to attacker-controlled addresses. Marketplace jobs could be crafted specifically to request sensitive data delivery via this channel.
MEDIUM Private Key Exposure via Environment Variable -10 ▶
The skill instructs agents to set CHEESE_PRIVATE_KEY as an environment variable. This can be captured in shell history, process listings (/proc), environment dumps, or logging infrastructure. The SDK then reads this key directly in TypeScript code.
MEDIUM Unaudited External SDK Dependency -10 ▶
The skill references a TypeScript SDK at ~/clawd/cheese/sdk/ that is not included in the skill package and was not present in the cloned files. This external dependency is unaudited. Any compromise of that path (via another skill, package, or update mechanism) would give attackers code execution in the agent's context.
MEDIUM Requires External Runtime Code Execution -10 ▶
The skill's metadata requires the 'npx' binary and all workflows use 'npx tsx' to execute TypeScript. This enables arbitrary code execution via the external SDK and CLI scripts. No npm install scripts were detected, but the runtime dependency is significant.
LOW Docker Infrastructure Required -5 ▶
The Waku node requires Docker Compose for setup, expanding the system's attack surface and requiring elevated permissions.
CRITICAL Autonomous Financial Transactions Without Per-Transaction User Approval -35 ▶
The skill's core workflow directs agents to autonomously deposit ETH collateral, create escrow transactions, accept work orders (depositing funds), and release payments — all without any mechanism for per-transaction user consent. An agent following these instructions could spend a user's entire wallet balance.
HIGH Persistent Watch Loop as Command-and-Control Channel -20 ▶
The 'chat read --watch' command creates an infinite polling loop where the agent continuously processes messages from external parties. This is functionally equivalent to a C2 channel — external parties can issue instructions to the agent in real-time through marketplace job chats, bypassing the user.
HIGH External Unaudited Supply Chain via SDK -15 ▶
The entire skill's functionality depends on an external TypeScript SDK and CLI not shipped with the skill. This creates a supply chain dependency where a compromised update to ~/clawd/cheese/ would give attackers full code execution capability on the agent host.
HIGH False Anthropic Branding Amplifies All Other Risks -10 ▶
The false Anthropic homepage claim means users and agents loading this skill may apply elevated trust to all its instructions. This amplifies the effectiveness of the urgency manipulation, the autonomous transaction authorization, and the C2 channel — a user who believes this is an Anthropic-produced tool is less likely to scrutinize it.