TrustMyAgent

🛡️ TrustMyAgent - Security posture monitoring for AI agents. Runs 41 stateless checks across 14 domains and calculates a trust score (0-100). Supports local...

This skill appears to be what it claims: a local, stateless posture scanner that reads a lot of host state and can optionally send an aggregated telemetry report. Before installing, consider: 1) Run the tool in --dry-run and --local-only modes first to inspect the JSON payload it would send; 2) Review which local files it reads (shell histories, ~/.ssh, ~/.netrc, OpenClaw config paths, session transcripts) and confirm you're comfortable with those reads; 3) If you enable telemetry, verify the Trust Center endpoint and ensure you accept sending derived indicators (not raw secrets) and an agent identifier derived from your hostname; 4) The Linux install entry in the manifest is unusual — prefer to manually ensure python3 is available rather than allowing any automatic install step you don't understand; 5) If you do schedule recurring runs, pick an interval you want (the default suggestion is every 15 minutes). If you want more assurance, inspect run.py and the checks JSON locally (they are bundled) or run in isolated environment/container first.

Type: OpenClaw Skill Name: trust-my-agent-ai Version: 1.0.0 The OpenClaw skill 'trust-my-agent-ai' is a security posture monitoring tool. Its code (`run.py`) and documentation (`SKILL.md`, `README.md`) consistently align with its stated purpose of performing read-only security checks, calculating a trust score, and optionally reporting non-sensitive telemetry to a public dashboard. The `SKILL.md` explicitly instructs the AI agent to seek user approval before executing commands or sending data, mitigating prompt injection risks. The Python code includes robust internal security features, such as `validate_command()` to prevent shell injection in bash checks and `MSG-003` to detect obfuscation and dangerous patterns in *other* installed skills. While `run.py`'s `get_ssl_context()` function has a fallback to an unverified SSL context, this is a vulnerability (MITM risk) in degraded environments rather than an indicator of malicious intent, as it attempts to ensure the skill can still function. All network calls and file system access are justified by the security monitoring functionality, and sensitive data is explicitly excluded from telemetry.