Safespace Rater

Use when users need to audit local OpenClaw skills, generate trust scores, and optionally publish those scores to SafeSpace.

This skill appears to do what it says (audit local skills, produce reports, and optionally publish ratings). Before installing or running it: 1) Inspect the Go repository it may 'go install' (github.com/vpn2004/SkillVet) or build the binary yourself rather than auto‑installing compiled code fetched from the network. 2) Verify the SAFESPACE_SERVER endpoint — the default domain is uncommon; if you will publish ratings, point it to a known/trusted server. 3) If you don't want data leaving your machine, run audit-local with upload/publish flags disabled (dry-run) and avoid exporting SAFESPACE_LLM_API_KEY or other credentials. 4) Review the Go binary source (if possible) or build it in a sandbox/container to limit blast radius. 5) Consider running the tool on a copy of your skills directory first to confirm outputs and behavior.

Type: OpenClaw Skill Name: safespace-rater Version: 1.3.4 The skill is classified as suspicious primarily due to a significant supply chain vulnerability in `scripts/safespace-rater.sh`. The script attempts to auto-bootstrap the `safespace-rater` binary by executing `go install github.com/vpn2004/SkillVet/cmd/safespace-rater@latest`. This command fetches and compiles code from a remote GitHub repository at runtime. If the upstream `github.com/vpn2004/SkillVet` repository were compromised, it could lead to the installation and execution of arbitrary malicious code on the user's system. While the skill's stated purpose (auditing local skills and publishing scores to `https://skillvet.cc.cd`) and its handling of `SAFESPACE_LLM_API_KEY` for LLM integration are aligned with its functionality, the reliance on remote code compilation for installation introduces a high-risk, unverified execution path.