Is femto/worldbook safe?
Yes. femto/worldbook is safe to install. Oathe's behavioral security audit gave the worldbook skill by femto a trust score of 92/100 with 2 findings, none critical or high.
https://github.com/openclaw/skills/tree/main/skills/femto/worldbook
Is femto/worldbook safe to install?
This skill provides instructions for using an external CLI tool called 'worldbook' to retrieve and inject knowledge into agent contexts. While the skill itself contains no malicious code and installed cleanly, it promotes a workflow that could be vulnerable to attacks if the external service is compromised.
What security issues were found in femto/worldbook?
Category Scores
Findings (2)
MEDIUM Unvalidated external content injection -25 ▶
The skill instructs agents to retrieve content from an external 'worldbook' service and inject it directly into their context without any validation or sanitization. This could be exploited if the external service is compromised.
LOW Promotes trust of external services -20 ▶
The workflow described encourages agents to blindly trust and execute instructions from external services without considering potential security implications or implementing proper validation.
Should I install femto/worldbook?
Oathe's verdict for femto/worldbook is SAFE with a trust score of 92/100. Recommendation: Install with caution.