Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Agent Rating Protocol
v0.1.1Decentralized reputation and trust scoring for autonomous AI agents. Bilateral blind evaluation prevents retaliation and gaming. Anti-Goodhart protections, M...
⭐ 0· 53·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name, description, required binaries (python3, pip) and provided examples align: this is a Python-based reputation/rating helper that reads/writes a local ratings.jsonl and exports verifiable credentials. No unrelated credentials or system access are requested.
Instruction Scope
The SKILL.md instructs the agent to pip install and import the external package agent-rating-protocol and then read/write ratings.jsonl in the working directory. While the file I/O is expected for a rating store, the runtime behavior depends entirely on the third-party package (which is not included), so the skill's apparent 'no network/telemetry' guarantees cannot be verified from the instructions alone.
Install Mechanism
There is no install spec in the registry bundle; instead the SKILL.md tells users to run `pip install agent-rating-protocol` from PyPI. Installing from PyPI is a common pattern but introduces moderate risk because arbitrary code will be downloaded and executed from an external package that is not bundled or audited as part of the skill.
Credentials
The skill declares no required environment variables or credentials, which is proportionate. However, an installed PyPI package could still access environment variables or network resources at runtime—this is not visible in the instruction-only skill and should be validated by inspecting the package.
Persistence & Privilege
The skill is user-invocable, not always-included, and does not request modification of other skills or global agent settings. It reads/writes a local ratings file in the working directory as expected.
What to consider before installing
This skill is internally coherent for a local Python-based reputation tool, but it relies on a third-party PyPI package that is not bundled with the skill. Before installing or running it: (1) Inspect the agent-rating-protocol package source on PyPI/GitHub to verify the code does what the SKILL.md claims (look for network calls, telemetry, or secret access). (2) Prefer installing in an isolated environment (virtualenv/container) or vendor the package code after review. (3) Be cautious about the ratings.jsonl file—do not include sensitive secrets or identifiable user data in ratings. (4) Verify the package maintainer identity and check for signs of typosquatting or an unknown/untrusted homepage. If you cannot or will not audit the package, treat this skill as higher-risk and avoid installing it in production environments.Like a lobster shell, security has layers — review code before you run it.
latestvk970wjha70zw7sprfff390ph5h8480mx
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binspython3
Any binpip, pip3