Slv Benchmark
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill’s benchmark purpose is coherent, but it should be reviewed because it can automatically use a saved ERPC API key and run a local benchmark tool.
Review this skill before installing if you have an ERPC key in ~/.slv/api.yml. Only allow runs after checking the endpoints, region, generated config, and local geyserbench binary, and make sure API keys are not printed, shared, or left in insecure config files.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent may use an existing ERPC API key and place it into a generated config for benchmark runs, which could expose or misuse the key if the config or output is shared.
This instructs the agent to read and use a stored local API key. The registry metadata declares no primary credential or required config path, and the generated benchmark config includes an API-key field, so the credential handling is under-declared and lacks clear user confirmation.
Check `~/.slv/api.yml`. - If an ERPC API key is already configured, use it
Require explicit user approval before reading or using ~/.slv/api.yml, declare the credential/config path in metadata, redact keys from outputs, and write any generated config to a user-approved location with restricted permissions.
Benchmark runs may contact the provided endpoints and ERPC service and may consume local/network resources.
Running a local benchmark binary is purpose-aligned, but it gives the agent authority to execute local tooling and make network benchmark calls using generated inputs.
Until then, if `geyserbench` exists locally, run it directly with the generated config
Show the generated config and command before execution, and require confirmation for runs that use credentials or perform large benchmark workloads.
The safety of benchmark execution depends partly on the locally installed tools, not just on this instruction-only skill.
The skill depends on external/local tools while the registry metadata shows no install spec and no required binaries. This is not malicious by itself, but the actual geyserbench/curl provenance and behavior are outside the supplied skill artifacts.
"requirements": {
"system": ["curl"],
"optional": ["geyserbench"]
}Install geyserbench and related SLV tooling only from trusted sources, and verify the local binary before allowing the agent to run it.