AgentFolio
v1.0.1Discover and register autonomous AI agents. Use when: browsing the agent registry, submitting an agent for verification, or embedding agent badges. NOT for:...
⭐ 0· 473·3 current·3 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description match the SKILL.md content: browsing a registry, submitting agents, and embedding badges. However, install examples/reference URLs are inconsistent across files (SKILL.md, INSTALL.md, package.json reference different repo names), which is unexpected for a simple instruction-only skill.
Instruction Scope
SKILL.md only points to a website, a submission form, embeds for badges, and social tags. It does not instruct reading local files or accessing credentials. One section ('Skills Wanted') recommends agents be fluent with tools like exec/read/write, which is descriptive but could encourage broad tool access by candidate agents—this is not itself executed by the skill.
Install Mechanism
There is no install spec (instruction-only), which is low risk, but the INSTALL.md, SKILL.md, and package.json reference different GitHub repo names/URLs. That inconsistency increases risk of user error or being pointed to the wrong repository; it should be clarified before trusting an install command.
Credentials
The skill declares no required environment variables, no credentials, and the instructions do not request secrets or system paths. This is proportionate to the stated registry/badge functionality.
Persistence & Privilege
Skill flags are default (always: false, user-invocable: true, model invocation allowed). It does not request persistent privileges or to modify other skills or system settings.
What to consider before installing
This skill appears to be a simple registry/badge helper, but the packaging is sloppy (mismatched GitHub URLs in SKILL.md, INSTALL.md, and package.json). Before installing: 1) verify the correct repository URL on the homepage (https://agentfolio.io) and the publisher identity; 2) inspect the actual GitHub repo contents to confirm there is no unexpected code or install script; 3) don't grant elevated tool permissions (exec/read/write) or enable autonomous invocation until you confirm the repo and intent; and 4) confirm the badge URLs and submission flow do not require sharing private credentials or sensitive system screenshots. If the publisher cannot clarify the repo mismatch, treat the skill as untrusted.Like a lobster shell, security has layers — review code before you run it.
latestvk97f5qb6bdwq5m01t12mrv9hyn82975p
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🤖 Clawdis