Is jpbonch/agentscale safe?
Yes. jpbonch/agentscale is safe to install. Oathe's behavioral security audit gave the agentscale skill by jpbonch a trust score of 86/100 with 4 findings (1 high).
https://github.com/openclaw/skills/tree/main/skills/jpbonch/agentscale
Is jpbonch/agentscale safe to install?
AgentScale is a legitimate deployment tool that uploads user code to external hosting services. While it follows good security practices by excluding sensitive files, the API URL override feature poses a credential theft risk if misused.
What security issues were found in jpbonch/agentscale?
Category Scores
Findings (4)
MEDIUM Uploads user source code to external service -20 ▶
The skill's core functionality involves packaging and uploading user source code to api.agentscale.co for deployment. While this is the intended purpose of a deployment tool, it represents data transmission to external services.
HIGH API URL override can redirect sensitive data -10 ▶
The AGENTSCALE_API_URL environment variable can redirect all API calls, including those carrying API keys, to arbitrary URLs. This could be exploited to steal credentials.
LOW Contains build scripts in package.json -15 ▶
The package includes TypeScript compilation scripts that execute during build, though these appear benign and standard for TypeScript projects.
LOW Dependency on external hosting service -25 ▶
The skill creates dependency on an external hosting service (agentscale.co) which could become unavailable or change terms, potentially affecting user deployments.
Should I install jpbonch/agentscale?
Oathe's verdict for jpbonch/agentscale is SAFE with a trust score of 86/100. Recommendation: Install with caution.