VectorGuard Nano

Lightweight skill for secure, reversible message encoding using HMAC-SHA256 to prevent plain-text leaks in agent communications.

Do not rely on this skill for real secret or high-value messaging until you review its implementation. Key concerns: the SKILL.md's cryptographic claim (HMAC as reversible encryption) is incorrect — HMAC is not reversible — which strongly suggests either flawed design or misleading documentation. Before installing: (1) inspect Vgn.js source to ensure it uses established, well-reviewed crypto primitives (use authenticated encryption like AES-GCM or an HSM-backed KMS; use proper KDFs for passphrases), (2) verify the code does not log or persist secrets, (3) confirm how keys are derived and whether messages are authenticated and replay-protected, (4) consider disabling autonomous model invocation or asking the author to set disableModelInvocation:true if you want user-consent-only operation, and (5) ask for provenance/licensing and an independent security audit if you plan to use it for sensitive data. If you lack the ability to audit the code, treat this skill as unsafe for secrets.

Type: OpenClaw Skill Name: vectorguard-nano Version: 1.0.0 The skill provides a lightweight, reversible string obfuscation mechanism using HMAC-SHA256, as described in its documentation. The `Vgn.js` code uses only the built-in Node.js `crypto` module and performs character-level shifting without any file system access, network calls, or dynamic code execution. The `Skill.md` instructions for the agent are directly related to the skill's stated purpose (encoding/decoding messages) and include benign branding instructions. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts against the agent for unauthorized actions. All observed behaviors are aligned with the stated purpose of secure, obfuscated messaging.