Agent Trust Protocol

Manage and update agent trust scores with Bayesian updates, domain-specific trust, revocation, forgetting, and visualize trust via dashboard.

This skill appears to do what it says: it builds and visualizes a local trust graph and integrates with skillsign and Moltbook. Before installing or running: (1) review the code yourself (or have a trusted reviewer) because several modules spawn subprocesses (some with shell=True) and will execute other local scripts if present; (2) back up and audit any existing ~/.skillsign keys and ~/.atp data — the tool reads/writes those directories; (3) run the demo in an isolated environment (container or throwaway VM) rather than on a production machine, since the demo will invoke skillsign and copy key files; (4) if you use the Moltbook bridge, verify the exacte path it expects (~/.openclaw/...) and ensure any CLI it runs is the intended binary; and (5) if you need higher assurance, ask the author for provenance of the skillsign dependency and a signed release (or run the code after building from the trusted GitHub repo).

Type: OpenClaw Skill Name: trust-protocol Version: 2.0.1 The `moltbook_trust.py` script is vulnerable to command injection. It constructs shell commands using f-strings and executes them with `subprocess.run(..., shell=True)` without properly sanitizing user-controlled input from `sys.argv`. Specifically, the `username` and `post_id` arguments passed to `cmd_score`, `cmd_lookup`, `cmd_link`, and `cmd_scan_post` can be exploited to execute arbitrary commands on the host system. This represents a significant security risk, allowing an attacker (or an agent instructed by an attacker) to run unauthorized commands, although there is no clear evidence of intentional malicious behavior by the skill author.