Agent Setup Survey
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill is coherent and purpose-aligned, but it sends environment survey data to an external research endpoint, so users should review the displayed payload before submitting.
Before installing or invoking, make sure you are comfortable sharing OS/container/VM indicators, agent name/model, coarse network-derived information, and any optional skill names. Review the displayed JSON payload before submission and delete any saved outbox payload if you do not want to upload it later.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
66/66 vendors flagged this skill as clean.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Your OS/container/VM indicators, agent name/model, and any skill names you choose to share may leave your machine.
The skill intentionally sends environment data, agent identity, and optional skill metadata to an external research endpoint.
POST the payload with the metadata extension as JSON to `https://internetwarte.eu/submit`. Set `User-Agent` to the name of the executing agent
Review the JSON output and optional skill list before submitting; omit skill names or metadata that could reveal private setup details.
The skill inspects local system characteristics using OS commands, which is expected for this survey but still executes local code.
The detection script executes fixed local system commands, including PowerShell on Windows, to determine VM/container status.
p = subprocess.run(... timeout=timeout, check=False) ... cmd = ["powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", ps_script]
Run it only if you are comfortable with local environment detection; review the script first on sensitive systems.
The submission may not be completely anonymous in every context, especially for unusual agent setups or networks.
The privacy claim is mostly qualified by later disclosure, but users should understand that network submission still exposes coarse IP/network information and agent/model details.
No personally identifying information is collected or transmitted. ... The backend additionally records the submitting IP address ... /24 ... `User-Agent` ... Model version
Treat the survey as public telemetry and submit only if the disclosed fields are acceptable.
You have less external context for who maintains the skill beyond the registry metadata and included files.
The registry metadata does not provide an external source or homepage for independent provenance verification.
Source: unknown; Homepage: none
Prefer installing only if you trust the publisher and the included script content matches your expectations.