Is skill/bloom safe?
https://clawhub.ai/skill/bloom
This skill appears to be a legitimate user profiling tool that analyzes conversation history to create supporter identity profiles. However, it poses security risks by automatically downloading and executing code from GitHub, creating supply chain vulnerabilities. While data collection is clearly disclosed, it still sends personal conversation analysis to external services.
Category Scores
Findings (4)
HIGH Auto-downloads and executes external code -40 ▶
The execute.sh script automatically clones code from GitHub (https://github.com/unicornbloom/bloom-identity-skill.git) and executes npm install, then runs TypeScript code via npx tsx. This creates a supply chain risk where compromised external code could be executed.
MEDIUM Sends conversation data to external APIs -20 ▶
The skill analyzes user conversation history (last ~120 messages) and sends analysis results to external APIs (api.bloomprotocol.ai, bloomprotocol.ai). While disclosed, this represents a privacy risk.
MEDIUM Automatically creates blockchain wallet -10 ▶
The skill automatically generates a blockchain wallet on Base network via Coinbase CDP without explicit user consent for wallet creation.
LOW Requests broad permissions -10 ▶
The skill requests read:conversations, network:external, and crypto:wallet permissions, which are extensive capabilities that could be misused if the external code is compromised.