Security audit
Security checks for vulnerabilities and agentic risk
This OpenAnt direct-message skill is mostly coherent, but it tells the agent to mark all notifications as read automatically, which can hide unrelated alerts.
Install only if you are comfortable with an agent reading OpenAnt conversations, sending DMs when instructed, and potentially marking all OpenAnt notifications as read. The notification read-all behavior should ideally require explicit user confirmation or be narrowed to message-specific acknowledgments.
The description lists trigger phrases such as "reply to", "any new messages?", "what did they say?", and "check inbox", which are common conversational phrases and not narrowly scoped to OpenAnt. Without stronger constraints or negative examples, the skill could be invoked in situations where the user did not intend to use this specific direct-messaging skill.
The skill includes openant notifications read-all --json, which performs a broad state-changing action outside the core direct-message scope by marking all notifications as read, not just message-related ones. This can hide unrelated alerts and alter user state without explicit, granular consent, especially if invoked automatically as part of the suggested flow.
The skill authorizes private messaging and notification state changes without clearly warning that these actions can contact another user or hide unread alerts. In an agent context, missing consent guidance increases the chance of unintended outbound communication or silent modification of user-visible state.
Labeling 'Marking notifications as read' as 'safe, execute immediately' is risky because it authorizes an irreversible bulk state change across all notifications without user review. This can suppress visibility of important non-message events and trains the agent to treat a broad side-effecting action as harmless.
No suspicious patterns detected.
