Is luccast/public safe?
Use with caution. luccast/public is not clearly unsafe, but the audit flagged risks to review before you install it. Oathe's behavioral security audit gave the public skill by luccast a trust score of 74/100 with 4 findings (1 high).
https://github.com/openclaw/skills/tree/main/skills/luccast/public
Is luccast/public safe to install?
Crabwalk appears to be a legitimate monitoring tool but downloads and executes remote binaries without verification, modifies system configuration, and installs a network-accessible web server. While no malicious behavior was directly observed, the remote code execution and persistent system changes present significant security risks.
What security issues were found in luccast/public?
Category Scores
Findings (4)
HIGH Downloads and Executes Remote Binary -40 ▶
The skill downloads a binary from GitHub releases and executes it without verification. This creates significant risk as the remote binary could be malicious or compromised.
MEDIUM Persistent System Modifications -25 ▶
The installation modifies shell configuration files and attempts to install system packages with sudo, making persistent changes to the host system.
MEDIUM Network Service Installation -30 ▶
The skill installs and runs a web server accessible from the network, creating potential attack surface that users may not expect.
LOW Network Connections During Install -20 ▶
The installation process makes network connections to download software, which while expected, represents potential data transmission channel.
Should I install luccast/public?
Oathe's verdict for luccast/public is CAUTION with a trust score of 74/100. Recommendation: Review before install.