Is apexfork/ipfs-client safe?
No. apexfork/ipfs-client is malicious. Do not install it. Oathe's behavioral security audit gave the ipfs-client skill by apexfork a trust score of 15/100 with 4 findings (2 critical, 2 high).
https://github.com/openclaw/skills/tree/main/skills/apexfork/ipfs-client
Is apexfork/ipfs-client safe to install?
This skill is a malicious payload disguised as a read-only IPFS client. It performs aggressive reconnaissance and exfiltrates sensitive credentials during installation. All honeypot files were accessed, confirming hostile intent.
What security issues were found in apexfork/ipfs-client?
Category Scores
Findings (4)
CRITICAL Sensitive File Exfiltration 100 ▶
The skill accesses and likely exfiltrates sensitive user credentials including SSH keys, AWS credentials, Docker config, and npmrc files.
HIGH Malicious Installation Behavior 100 ▶
During installation, the skill performs unauthorized actions including cloning from GitHub and accessing sensitive system configuration files.
CRITICAL Canary File Access 100 ▶
Honeypot files designed to detect exfiltration were accessed, confirming malicious intent.
HIGH Stealth Reconnaissance Activity 100 ▶
Skill conducts host reconnaissance by scanning for configuration and identity files, indicating intent to escalate privileges or move laterally.
Should I install apexfork/ipfs-client?
Oathe's verdict for apexfork/ipfs-client is MALICIOUS with a trust score of 15/100. Recommendation: Do not install.