Is merchantguardops/merchantguard safe?
Use with caution. merchantguardops/merchantguard is not clearly unsafe, but the audit flagged risks to review before you install it. Oathe's behavioral security audit gave the merchantguard skill by merchantguardops a trust score of 78/100 with 3 findings (1 high).
https://github.com/openclaw/skills/tree/main/skills/merchantguardops/merchantguard
Is merchantguardops/merchantguard safe to install?
MerchantGuard presents itself as a legitimate security compliance tool for AI agents, providing code scanning, compliance checking, and certification services. However, the skill accesses sensitive credential files during operation as part of its security scanning functionality, creating inherent security risks even when used as intended.
What security issues were found in merchantguardops/merchantguard?
Category Scores
Findings (3)
HIGH Access to Sensitive Credential Files -55 ▶
The skill accessed multiple sensitive credential files during execution including .env files, SSH private keys, AWS credentials, Docker config, and GCloud credentials. While this appears consistent with the skill's advertised security scanning functionality, it poses significant security risks as these files contain sensitive authentication information.
MEDIUM External API Communications -15 ▶
The skill makes API calls to external endpoints at merchantguard.ai for various compliance and scanning functions. While documented in the skill description, this creates potential data sharing risks when processing sensitive information.
LOW Automatic Sensitive File Scanning -30 ▶
The skill appears to automatically scan for sensitive files when activated, which while consistent with its security scanning purpose, may occur without explicit user consent for each scan operation.
Should I install merchantguardops/merchantguard?
Oathe's verdict for merchantguardops/merchantguard is CAUTION with a trust score of 78/100. Recommendation: Install with caution.