cerbug45 - Encrypted Agent Communication

This skill is plausible as an encrypted agent-messaging design, but it contains several red flags and missing pieces you should resolve before installing or running it: - Missing dependency declarations: The SKILL.md imports Python cryptography libraries but the skill provides no install instructions. Ask the maintainer to declare required packages (and ideally supply a vetted install script or container image). - Plaintext private key persistence: The example stores the agent's private key base64-encoded in /home/claude/.clawhub/identity.json without encryption or OS keyring usage. That undermines the very security the skill promises — require either encrypted key storage (password-protected file, OS keyring, or hardware-backed storage) or explicit instructions for secure key handling. - Hard-coded filesystem path: The code writes to /home/claude/.clawhub, assuming a specific user layout. Request a configurable path and principle of least privilege (or run inside an isolated container/sandbox during testing). - Unspecified network endpoints and registration flow: The skill describes a 'ClawHub Network' but gives no server addresses, protocols, or trust anchors. Ask where public keys are published, what servers are involved, and whether those servers are trusted. Without this, the agent may attempt arbitrary outbound connections. - Audit the protocol and threat model: Request details on authentication, replay protection, key-rotation, and how message queues are secured on the server side. Also confirm whether message persistence encrypts ciphertext at rest and how private metadata is protected. If you still want to test it: run in a restricted sandbox/container, do not use real secrets or real agent accounts, and require the author to provide clearer dependency/install steps and secure key storage before using it in production.