Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
private computation
v1.0.0Zero-Knowledge Execution for Sensitive Agent Tasks - Privacy computing framework for AI Agents
⭐ 0· 170·0 current·0 all-time
byJustin Liu@zhenstaff
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md advertises encryption, TEE isolation, ZK proofs and blockchain-style audit logs and shows npm install instructions, but the registry entry contains only the SKILL.md (no code files, no install spec). That makes the claimed capabilities unverifiable from this bundle and indicates a mismatch between the described functionality and what the skill actually provides.
Instruction Scope
Instructions show API usage patterns that store and retrieve secrets (agent.setSecret / getSecret), execute sensitive tasks, and write audit logs (storagePath defaults to ~/.openclaw). These calls are in-scope for a private-computation library, but the document gives no details about where audit logs are transmitted, how the masterKey is stored/derived, or how isolation is achieved — missing details that matter for secrets handling.
Install Mechanism
Although the README shows 'npm install openclaw-private-computation' and 'clawhub install', the registry provides no install spec and no packaged code. That difference is suspicious: either this is documentation-only (which is fine) or the intended package must be fetched from an external registry (which should be audited before use).
Credentials
The skill declares no required environment variables or credentials, yet the examples demonstrate storing/using many sensitive API keys (OPENAI_API_KEY, MEDICAL_API_KEY, BANK_API_KEY, etc.). Absence of declared required envs is not itself dangerous, but you should not assume the skill (or the separately published npm package) treats or transmits those secrets safely without review.
Persistence & Privilege
The skill does not request always:true and is user-invocable only. However, the documented default storagePath (~/.openclaw) implies the library (if installed) would write to the user's home directory — verify storage/encryption details before saving secrets.
What to consider before installing
This registry entry is an instruction-only README that promises advanced privacy features but contains no code or install metadata. Before using it or running the suggested npm install: 1) Verify the package exists on npm (or the GitHub repo) and inspect its source code — do not blindly npm install. 2) Confirm where audit logs are stored or transmitted, and how the masterKey is generated and protected. 3) Avoid storing real production secrets (medical, banking, or live LLM keys) until you can audit the implementation. 4) If you need these features for compliance, prefer well-audited libraries or vendor-provided solutions and consider an independent security review. If you want, I can: (a) check npm or GitHub for the referenced package and report what I find, or (b) list specific questions to ask the package author to verify safety.Like a lobster shell, security has layers — review code before you run it.
latestvk97dgv9sgdc6kx8aysq06217ah82t44a
License
MIT-0
Free to use, modify, and redistribute. No attribution required.