Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
NotaryOS
v2.4.0Seal AI agent actions with Ed25519 cryptographic receipts. Verify what your agent did and prove what it chose not to do.
⭐ 1· 211·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill name/description (issue/verify cryptographic receipts) matches the declared requirements (python3, a Notary SDK, and an optional NOTARY_API_KEY). Requesting a NOTARY_API_KEY as the primary credential is reasonable. However, the SKILL.md references multiple domains (Github and notaryos.org) while the runtime endpoints are on api.agenttownsquare.com, which is an unexplained domain mismatch that deserves confirmation from the publisher.
Instruction Scope
Runtime instructions are limited: sanitize payloads using the included sanitize.py (which is a pure function with no I/O), then call the NotaryOS API endpoints. The SKILL.md explicitly documents what fields to exclude and which endpoints are used. There is no instruction to read unrelated local files or other environment variables in the provided files.
Install Mechanism
The metadata lists an install kind 'uv' package: notaryos and the docs also show 'pip install notaryos'. 'uv' is an uncommon installer here and the registry metadata does not prove the origin (PyPI vs another host). Installing an SDK will pull code that runs network calls; you should verify the upstream package (PyPI project, source repository, release artifacts) before installing. No archive-URL or untrusted download was found in the skill bundle itself.
Credentials
Only NOTARY_API_KEY is declared as the primary credential and the SKILL.md states a demo key is auto-injected when it is not set. That level of credential access is proportional to a remote receipt service. The included sanitize helper does not access environment variables.
Persistence & Privilege
The skill is not force-installed (always: false) and does not request elevated or system-wide persistent privileges in the provided files. Autonomous invocation is allowed (platform default) but is not combined with other high-risk flags here.
What to consider before installing
This skill appears to implement what it claims: a sanitize helper (pure, local) plus use of a remote Notary API. Before installing or granting a production NOTARY_API_KEY: 1) verify the upstream package source (PyPI project page and GitHub repository) and ensure the release artifacts match the source; 2) confirm why the API domain (api.agenttownsquare.com) differs from the notaryos.org/GitHub URLs and that the service operator is who you expect; 3) prefer creating a limited-scope/test key first (or use the demo key) and monitor outgoing network calls during initial runs. If you need high assurance, review the notaryos SDK source code that will be installed (not just sanitize.py) to confirm it only calls the documented endpoints and handles secrets as promised.Like a lobster shell, security has layers — review code before you run it.
agent-safetyvk9770xhj2tvrapnh0ksdzp2pzx83bs18auditvk9770xhj2tvrapnh0ksdzp2pzx83bs18compliancevk9770xhj2tvrapnh0ksdzp2pzx83bs18cryptographicvk9770xhj2tvrapnh0ksdzp2pzx83bs18ed25519vk9770xhj2tvrapnh0ksdzp2pzx83bs18latestvk9770xhj2tvrapnh0ksdzp2pzx83bs18receiptsvk9770xhj2tvrapnh0ksdzp2pzx83bs18securityvk9770xhj2tvrapnh0ksdzp2pzx83bs18
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🛡️ Clawdis
Binspython3
Primary envNOTARY_API_KEY
Install
uv
uv tool install notaryos