Safe Encryption

Encrypt, decrypt, and manage keys with the SAFE CLI — a modern GPG alternative with post-quantum support.

This skill mostly does what it says (manage encryption via the SAFE CLI), but there are several red flags you should consider before installing or allowing the agent to act autonomously: 1) The SKILL.md tells the agent to auto-install a prebuilt binary from https://thesafe.dev and move it into /usr/local/bin with sudo — don't allow that without manual review. 2) The document references SAFE_PASSPHRASE and env-based automation, but the registry metadata lists no required envs — expect the skill to read environment variables if present. 3) The skill instructs the agent to automatically try all keys in ~/.safe/keys/ for decryption and to perform cryptographic operations without confirmation — this could cause the agent to access many local secrets or decrypt files unintentionally. 4) If you want to use this skill, install the SAFE binary yourself (and verify checksums/signatures), deny automatic installation, require explicit confirmation before any encrypt/decrypt action, and avoid letting the agent probe your key directory or environment variables. If you prefer lower risk, use the browser-based alternative described and interact manually or via your own trusted browser automation with careful controls.

Type: OpenClaw Skill Name: safe-encryption-skill Version: 0.1.0 The skill is classified as suspicious due to several high-risk behaviors and instructions to the AI agent. Most critically, the `SKILL.md` instructs the agent to automatically download and install a binary from `https://thesafe.dev` using `sudo` without user confirmation, posing a significant supply chain and privilege escalation risk. Furthermore, the skill directs the agent to use a tool (`safe`) that automatically discovers and attempts to use SSH private keys from `~/.ssh/`, granting access to highly sensitive credentials. The skill also explicitly instructs the agent to bypass user confirmation for both installation and encryption/decryption operations, reducing security safeguards.