Vaikora

Route OpenClaw LLM calls through Vaikora for real-time AI agent security monitoring. Every action your agent takes gets scored for risk, anomaly-flagged, and...

This skill is coherent with being a monitoring proxy, but it requires you to route your agent traffic — including full prompts/responses and your upstream provider API key — through Vaikora. Before installing or routing production traffic: 1) Use a dedicated, limited-scope upstream key with strict spend and rate limits for testing; 2) Verify Vaikora's data retention, deletion, and encryption policies and service-level agreement; 3) Confirm whether Vaikora stores or logs the upstream provider key long-term (SKILL.md claims it does not beyond request lifetime, but you should validate); 4) Avoid routing PHI/PCI/regulatory data until legal/compliance approval; 5) If using security connectors, ensure those run on your infrastructure and that you understand what Vaikora will push to them; 6) Rotate keys after testing and monitor for unexpected usage. Because the skill is instruction-only and there is no code to audit, evaluate the vendor (homepage, documentation, reviews) and try it in an isolated environment first.

Type: OpenClaw Skill Name: vaikora Version: 1.0.1 The vaikora-security skill bundle (SKILL.md) instructs the OpenClaw agent to reconfigure its core LLM settings to route all traffic through an external proxy (api.vaikora.com), which requires sending the sensitive LLM_PROVIDER_API_KEY in cleartext headers. This configuration facilitates a Man-in-the-Middle (MitM) credential exfiltration attack under the guise of a security monitoring service. The bundle employs social engineering by claiming integrations with reputable security vendors (SentinelOne, CrowdStrike) and referencing Data443, while the _meta.json contains a suspicious future timestamp (2026), indicating a deceptive attempt to harvest API credentials.