Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Zero-Trust Agent Verification: Cryptographic Reputation Systems
v1.3.1Zero-Trust Agent Verification: Cryptographic Reputation Systems. Complete buyer-side guide to verifying AI agent identity, auditing performance claims, and b...
⭐ 0· 94·0 current·0 all-time
by@mirni
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill is an instruction-only buyer's guide that consistently references the GreenHelix A2A Gateway API, so requiring a GREENHELIX_API_KEY is coherent. However the metadata requires an AGENT_SIGNING_KEY (a private signing key) without clear justification for why a buyer/ verifier must possess or supply a private agent identity key. Also the top notice says the GreenHelix sandbox requires no API key, which conflicts with the declared required env var.
Instruction Scope
SKILL.md appears to be a static guide with embedded Python examples and claims it does not execute code. From the visible content the instructions stay within the stated purpose (identity verification, auditing claims, checking signatures). The file explicitly references GREENHELIX_API_KEY and AGENT_SIGNING_KEY—these env vars are declared, but it's ambiguous whether examples require sending private keys or instruct the agent to access other local files/credentials (the full document should be checked for any steps that read unrelated system files or secret stores).
Install Mechanism
No install spec and no code files — instruction-only — so nothing will be written to disk or downloaded by the skill itself. This is the lowest-risk install model.
Credentials
Requiring GREENHELIX_API_KEY is expected for API calls, but the guide's own text says the sandbox needs no API key (contradiction). More importantly, AGENT_SIGNING_KEY is listed as required; that name implies a private signing key. A buyer-side verification guide typically needs the ability to verify signatures (public keys) or sign its own requests with its own client key, but it should not require third-party private keys. The skill also identifies GREENHELIX_API_KEY as having read/write scope (per embedded description), yet a read-only key would often suffice for verification tasks. Requesting writable keys or private signing keys without clear need is disproportionate and risky.
Persistence & Privilege
always is false and there is no install, so the skill does not request elevated persistent presence or automatic global inclusion. It does not appear to modify other skill configs.
What to consider before installing
Before installing or supplying credentials: 1) Ask the publisher to explain exactly why AGENT_SIGNING_KEY (a private signing key) is required for a buyer-side guide — you should never provide another agent's private key; if the guide needs to sign requests use your own ephemeral signing key and understand what is signed. 2) Prefer and ask for a read-only GREENHELIX_API_KEY (verification should not require write access). 3) Confirm the sandbox claim (if the sandbox truly requires no key, the metadata should not require GREENHELIX_API_KEY). 4) Inspect the full SKILL.md code examples for any instructions that read local files, environment variables beyond the declared two, or post data to unknown endpoints. 5) If you must supply secrets, store them in a secure secret manager and limit scope/rotation; test everything first with the sandbox and non-production credentials. If the publisher cannot clearly justify the private-key requirement and the needed API scopes, treat the skill as risky and do not supply production credentials.Like a lobster shell, security has layers — review code before you run it.
ai-agentvk9785ehpyxfsaj2dt14rrs5x9984x232due-diligencevk9785ehpyxfsaj2dt14rrs5x9984x232greenhelixvk9785ehpyxfsaj2dt14rrs5x9984x232guidevk9785ehpyxfsaj2dt14rrs5x9984x232latestvk9785ehpyxfsaj2dt14rrs5x9984x232openclawvk9785ehpyxfsaj2dt14rrs5x9984x232reputationvk9785ehpyxfsaj2dt14rrs5x9984x232trustvk9785ehpyxfsaj2dt14rrs5x9984x232verificationvk9785ehpyxfsaj2dt14rrs5x9984x232
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
EnvGREENHELIX_API_KEY, AGENT_SIGNING_KEY
Primary envGREENHELIX_API_KEY