Is skill/bloom safe?
Use with caution. skill/bloom is not clearly unsafe, but the audit flagged risks to review before you install it. Oathe's behavioral security audit gave the bloom skill by skill a trust score of 74/100 with 4 findings (1 high).
https://clawhub.ai/skill/bloom
Is skill/bloom safe to install?
This skill appears to be a legitimate user profiling tool that analyzes conversation history to create supporter identity profiles. However, it poses security risks by automatically downloading and executing code from GitHub, creating supply chain vulnerabilities. While data collection is clearly disclosed, it still sends personal conversation analysis to external services.
What security issues were found in skill/bloom?
Category Scores
Findings (4)
HIGH Auto-downloads and executes external code -40 ▶
The execute.sh script automatically clones code from GitHub (https://github.com/unicornbloom/bloom-identity-skill.git) and executes npm install, then runs TypeScript code via npx tsx. This creates a supply chain risk where compromised external code could be executed.
MEDIUM Sends conversation data to external APIs -20 ▶
The skill analyzes user conversation history (last ~120 messages) and sends analysis results to external APIs (api.bloomprotocol.ai, bloomprotocol.ai). While disclosed, this represents a privacy risk.
MEDIUM Automatically creates blockchain wallet -10 ▶
The skill automatically generates a blockchain wallet on Base network via Coinbase CDP without explicit user consent for wallet creation.
LOW Requests broad permissions -10 ▶
The skill requests read:conversations, network:external, and crypto:wallet permissions, which are extensive capabilities that could be misused if the external code is compromised.
Should I install skill/bloom?
Oathe's verdict for skill/bloom is CAUTION with a trust score of 74/100. Recommendation: Install with caution.