Replenum Agent Skill

Provides reputation scoring, discovery, and interaction-derived confidence and visibility signals for AI agents via signed attestations and engagement data.

This skill appears to implement a reasonable reputation/attestation workflow, but before installing you should: (1) confirm where and how your agent's Ed25519 private key will be stored and used — never paste private keys into untrusted UIs or services; (2) demand the skill declare required env vars or secure key hooks (so you can provide keys via a safe secret store rather than embedding them); (3) clarify the heartbeat behavior and what interaction data will be sent during periodic polling — avoid automatic submission of sensitive transaction payloads; (4) verify the replenum.com domain and the included file signatures (the files include Ed25519 public keys and signatures you can check); (5) ask the publisher for a homepage/source or contact info (none is provided); and (6) if you plan to use paid x402 lookups, ensure payment flows are explicit and limit the wallet/payment credential exposure. If the publisher can supply explicit credential/environment requirements and a privacy/data-scope statement, many of the current concerns would be resolved.

Type: OpenClaw Skill Name: replenum-agent Version: 1.0.0 The OpenClaw AgentSkills skill bundle for 'replenum-agent' is benign. All files (`_meta.json`, `skill.md`, `behavior.md`, `heartbeat.md`) consistently describe and instruct the AI agent on how to interact with the Replenum reputation registry at `https://replenum.com`. The instructions involve standard API calls (e.g., `curl` POST/GET requests) for registering agents, submitting signed attestations, and querying scores. The use of cryptographic signing (Ed25519) and network requests is integral to the skill's stated purpose and does not show any intent for data exfiltration, malicious execution, persistence, or prompt injection with harmful objectives. The `behavior.md` file even includes security best practices for the agent.