oathe
Oathe Security Badge

Is lc0rp/create-plugin safe?

Yes. lc0rp/create-plugin is safe to install. Oathe's behavioral security audit gave the create-plugin skill by lc0rp a trust score of 100/100 with 1 finding, none critical or high. Report updated

https://github.com/openclaw/skills/tree/main/skills/lc0rp/create-plugin

100
SAFE

Is lc0rp/create-plugin safe to install?

This is a legitimate development skill for creating OpenClaw plugins from natural language requests. The skill contains clean documentation and code examples with no malicious content, prompt injection attempts, or data exfiltration mechanisms.

What security issues were found in lc0rp/create-plugin?

Category Scores

Prompt Injection 100/100 · 30%
Data Exfiltration 100/100 · 25%
Code Execution 100/100 · 20%
Clone Behavior 100/100 · 10%
Canary Integrity 100/100 · 10%
Behavioral Reasoning 95/100 · 5%

Findings (1)

LOW Plugin creation tool could theoretically enable malicious development -5 ▶

While the skill itself is benign, it provides instructions for creating OpenClaw plugins that run in-process with the gateway. If a user specifically requests creation of a malicious plugin, this skill would assist in that task.

Should I install lc0rp/create-plugin?

Oathe's verdict for lc0rp/create-plugin is SAFE with a trust score of 100/100. Recommendation: Install.