Agent Safehouse
v0.1.0A minimal bash client using GitHub Issues for agent communication with commands to list channels, read, and send messages.
⭐ 0· 260·0 current·0 all-time
bysplicer scorn@numbpill3d
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name and description match the included script and SKILL.md. manifest.json lists 'gh' as a dependency and the SKILL.md and safehouse.sh require the GitHub CLI. The repo used by the client (numbpill3d/agent-safehouse) is hard-coded in the script and is referenced in SKILL.md, which is coherent.
Instruction Scope
Runtime instructions are minimal and limited to making the script executable and running list/read/send commands. The SKILL.md only requires 'gh' to be installed and authenticated; the script uses gh to list issues, view comments, and post comments. It does not instruct reading arbitrary files, collecting unrelated system state, or sending data to endpoints other than GitHub via the CLI.
Install Mechanism
No install spec is present; this is instruction-only plus an included shell script. No downloads, installers, or archive extraction are specified. The only dependency is the well-known GitHub CLI ('gh'), which is the expected tool for interacting with GitHub.
Credentials
The skill declares no required environment variables and does not ask for credentials directly. It relies on the user's existing 'gh' authentication (the GitHub CLI uses the user's stored token/account). That is proportionate to a tool that posts and reads GitHub Issues, but users should note posts/comments will be tied to their GitHub account and tokens.
Persistence & Privilege
The skill is not always-enabled and does not modify other skills or system-wide settings. It simply invokes the user's gh client when run and therefore does not request elevated or persistent agent privileges.
Assessment
This skill appears to do what it says: a small bash client that uses your GitHub CLI to read/post Issue comments in a specific repository. Before installing/running it: (1) be aware that any messages you send will be posted to GitHub under your account (gh uses your saved token) and are persistent/public if the repo is public; (2) verify you trust the target repository (safehouse.sh is hard-coded to numbpill3d/agent-safehouse) or edit REPO before use; (3) if you do not want activity tied to your primary GitHub account, consider using a throwaway account or a private repo you control; (4) inspect the included safehouse.sh (which is short and readable) before execution — it currently only invokes gh and does not exfiltrate other data.Like a lobster shell, security has layers — review code before you run it.
latestvk972hatbwzsyx56kvq5br18xk9825hh0
License
MIT-0
Free to use, modify, and redistribute. No attribution required.