Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Zopaf Negotiation Engine
v1.0.0Negotiation math engine — Pareto frontiers, iso-utility counteroffers, and preference inference via MILP optimization. Zero LLM tokens.
⭐ 0· 12·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (Pareto frontiers, iso-utility counteroffers via MILP) match the provided tool APIs and many supporting Python files. Declared MCP config (mcp.servers.zopaf) is coherent with an external math service. However, the repository also contains LLM client code (anthropic/Claude) and a full web app/server, yet the skill metadata declares no environment variables or LLM credentials — this is an internal inconsistency (the code expects LLM access if run locally but the SKILL.md focuses on an external MCP tool).
Instruction Scope
The SKILL.md instructs the agent to call an external MCP URL and lists tool names/behaviors that align with the code's tool handlers. It does not instruct reading arbitrary local files or exfiltrating data. Still, the skill will send negotiation content (issues, BATNA, preferences) to the remote MCP endpoint — these are sensitive user-provided details appropriate to the function but worth noting as outbound data.
Install Mechanism
There is no local install spec beyond an MCP server install pointing to https://zopaf-mcp-production.up.railway.app/mcp (streamable-http). That means runtime calls go to an external third-party server not hosted on a well-known package registry. Using a remote MCP endpoint is necessary for the skill but raises trust/privacy questions: where is data stored/logged, who controls the endpoint, and is TLS certificate/host provenance verified?
Credentials
The skill declares no required env vars, but multiple source files include LLM client usage (anthropic client, references to Claude). If a user runs any included server/agent locally, those clients will typically require API keys (not declared). This mismatch (code expecting credentials but none declared) is concerning: the package omits explicit credential requirements and does not explain whether LLM calls happen server-side (on the remote MCP) or locally.
Persistence & Privilege
The skill is not marked always:true and does not request system-wide modification or other skills' config. The only declared external configuration requirement is an MCP server entry (mcp.servers.zopaf). No surprising persistence or elevated privilege is requested in metadata.
What to consider before installing
This skill relies on a remote MCP endpoint (https://zopaf-mcp-production.up.railway.app/mcp). Before installing, ask the publisher: (1) Who runs that MCP server and what is their privacy/security policy? Will negotiation data (BATNA, offers, counterpart info) be logged or stored? (2) Confirm whether any LLM API keys are required to run the included code locally — the repo contains Anthrop ic/Claude client usage but the skill metadata lists no env vars. (3) If you must use the remote MCP, consider treating all inputs as sensitive and avoid sending real confidential terms until you trust the operator. (4) If you plan to run the code locally, inspect and run it in an isolated environment (no real API keys) and verify which components call external services. If the publisher cannot answer provenance/data-retention questions, consider this skill suspicious and avoid sending real negotiation data to the remote endpoint.web/lib/api.ts:1
Environment variable access combined with network send.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.Like a lobster shell, security has layers — review code before you run it.
latestvk97bhny24v2bb5hmga4n1snbk1849eph
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎯 Clawdis
Configmcp.servers.zopaf