← Back to Skills Marketplace
Safe
by
Steven Obiajulu
· GitHub ↗
· v0.2.0
· MIT-0
162
Downloads
0
Stars
0
Active Installs
2
Versions
Install in OpenClaw
/install safe
Description
Draft and fill Y Combinator SAFE templates — valuation cap, discount, MFN, pro rata side letter. Standard startup fundraising documents for convertible equit...
Usage Guidance
This skill appears coherent for filling SAFE templates, but pay attention to two operational risks before using it: (1) Remote MCP will send sensitive fundraising fields (company name, investor name, purchase amount, valuation cap, state, etc.) to openagreements.ai—confirm the user consents and validate the service's authenticity and privacy policy. (2) If you use the Local CLI path, ensure the agent or operator strictly implements the documented sanitization rules (output filename regex, reject shell metacharacters and control characters, use a quoted heredoc, and pin the npm package version) and be aware of potential /tmp symlink/TOCTOU issues; consider using a secure, unique temp file per invocation rather than a fixed path. Also always review the generated SAFE before signing, pin the CLI version as recommended, and verify the open-agreements npm package and its source prior to installation.
Capability Analysis
Type: OpenClaw Skill
Name: safe
Version: 0.2.0
The 'safe' skill provides a structured workflow for generating Y Combinator SAFE documents via a remote MCP or local CLI. It demonstrates a strong security posture by providing the agent with explicit shell command sanitization rules (e.g., regex for filenames, quoted heredocs, and metacharacter rejection) in SKILL.md and template-filling-execution.md to prevent RCE. It also transparently discloses that the remote MCP path sends data to openagreements.ai and includes instructions to treat third-party template data as untrusted, effectively mitigating prompt injection risks.
Capability Tags
Capability Assessment
Purpose & Capability
Name/description match what the skill does: produce filled SAFE DOCX files via a hosted MCP or an optional local CLI. No unrelated credentials, binaries, or config paths are requested.
Instruction Scope
The SKILL.md stays within purpose but delegates critical safety responsibilities (shell-parameter sanitization, rejecting control characters, output filename validation, and user confirmation before sending values to the hosted service) to the agent or operator. It also mandates a fixed temp path (/tmp/oa-values.json) and invoking the local CLI, which are reasonable for the task but require correct implementation by the runner to avoid command-injection or TOCTOU/symlink risks.
Install Mechanism
This is an instruction-only skill with no install spec. It recommends either a hosted MCP (openagreements.ai) or installing the public npm package open-agreements; both are plausible and proportional. No arbitrary downloads or extract operations are specified.
Credentials
The skill requests no environment variables, no credentials, and no config paths. The only data it transmits (when using Remote MCP) are the template field values required to fill SAFEs—this is consistent with the stated purpose, and the skill explicitly asks for user consent before sending such data.
Persistence & Privilege
always is false and the skill does not request persistent presence or modify other skills or system-wide settings. Autonomous invocation is allowed (platform default) but not combined with elevated privileges or broad credential access.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install safe - After installation, invoke the skill by name or use
/safe - Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.2.0
Fix: populate version field
v0.2.1
Add inline trust-boundary, shell-safety, and hosted Remote MCP disclosure guidance for ClawHub review.
Metadata
Frequently Asked Questions
What is Safe?
Draft and fill Y Combinator SAFE templates — valuation cap, discount, MFN, pro rata side letter. Standard startup fundraising documents for convertible equit... It is an AI Agent Skill for Claude Code / OpenClaw, with 162 downloads so far.
How do I install Safe?
Run "/install safe" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Safe free?
Yes, Safe is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Safe support?
Safe is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Safe?
It is built and maintained by Steven Obiajulu (@stevenobiajulu); the current version is v0.2.0.
More Skills