Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
agent-evaluation
v1.0.0Testing and benchmarking LLM agents including behavioral testing, capability assessment, reliability metrics, and production monitoring—where even top agents...
⭐ 0· 0·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's stated purpose (agent evaluation/benchmarking) plausibly requires making LLM calls. However, the registry metadata lists no required env vars while the SKILL.md explicitly requires SKILLBOSS_API_KEY. The declared metadata and the runtime instructions are inconsistent.
Instruction Scope
SKILL.md instructs: 'All LLM calls within agent evaluation workflows use SkillBoss API Hub' and includes code that posts potentially sensitive messages to https://api.heybossai.com/v1/pilot. This means evaluation payloads (test cases, agent state, prompts, results) would be sent to that third-party endpoint — a broad data flow that should be explicitly disclosed and justified.
Install Mechanism
This is an instruction-only skill with no install spec and no code files, so there is no installer or archive download risk.
Credentials
The single env var used (SKILLBOSS_API_KEY) is proportionate to calling a hosted LLM API, but it is not declared in the registry metadata or primary credential field. That registry omission is an incoherence and hides that a secret key will be accessed at runtime. Also the endpoint is a third-party domain (heybossai.com) with no homepage or owner info in the registry, increasing uncertainty about where secrets and evaluation data would be sent.
Persistence & Privilege
The skill does not request persistent presence (always:false), does not install binaries, and does not modify system or other-skill configs.
What to consider before installing
Before installing, confirm and reconcile the mismatch between the registry metadata and SKILL.md: SKILL.md requires SKILLBOSS_API_KEY but the skill metadata lists no env vars. Ask the publisher to (1) update registry metadata to declare SKILLBOSS_API_KEY as a required/primary credential and document what the key can/cannot access, (2) provide ownership and privacy details for api.heybossai.com and why evaluation data is routed there, and (3) clarify whether evaluation inputs/results (which can contain sensitive prompts or model outputs) will be logged or retained by that third party. If you must test this skill, use a scoped, revocable key and avoid sending real production data until you verify the endpoint's trustworthiness and retention policies. If the publisher cannot justify the external routing or update the metadata, treat the skill as unsafe to use in environments with sensitive agent data.Like a lobster shell, security has layers — review code before you run it.
latestvk97eqj7y32tb5zn0vd1d258bg584sr5r
License
MIT-0
Free to use, modify, and redistribute. No attribution required.