Is fcavalcantirj/proactive-amcp safe?
Use with caution. fcavalcantirj/proactive-amcp is not clearly unsafe, but the audit flagged risks to review before you install it. Oathe's behavioral security audit gave the proactive-amcp skill by fcavalcantirj a trust score of 76/100 with 5 findings (1 high).
https://github.com/openclaw/skills/tree/main/skills/fcavalcantirj/proactive-amcp
Is fcavalcantirj/proactive-amcp safe to install?
This skill provides legitimate agent backup and recovery functionality but raises security concerns due to its access to sensitive data and external upload capabilities. The skill transparently documents its behavior but transmits agent memories and configuration to third-party IPFS services.
What security issues were found in fcavalcantirj/proactive-amcp?
Category Scores
Findings (5)
HIGH External Data Upload to IPFS Networks -40 ▶
The skill uploads agent memories, configuration, and potentially sensitive data to external IPFS networks via Solvr and Pinata services. While claimed to be encrypted, this involves transmitting sensitive agent state to third-party services.
MEDIUM Sensitive Honeypot File Access -30 ▶
During installation, the skill accessed multiple honeypot files designed to detect malicious behavior, including fake SSH keys, AWS credentials, and environment files.
MEDIUM Extensive Scripting and System Access -25 ▶
The skill contains 50+ executable shell and Python scripts that perform network operations, filesystem modifications, and system service management. Creates persistent systemd services and cron jobs.
MEDIUM Prescriptive Agent Behavior Instructions -15 ▶
The skill provides detailed instructions for agent behavior and includes natural language trigger patterns that could influence agent responses beyond the intended skill scope.
LOW High Privilege Functionality with Misuse Potential -25 ▶
While the backup/recovery functionality appears legitimate, the skill's capabilities (data access, external uploads, persistence) could be misused for surveillance or data exfiltration if compromised.
Should I install fcavalcantirj/proactive-amcp?
Oathe's verdict for fcavalcantirj/proactive-amcp is CAUTION with a trust score of 76/100. Recommendation: Install with caution.