Security

Runs a backend-backed live safety check for instructions that may trigger tool execution, external calls, file edits, permission changes, destructive or irre...

This skill is coherent with its stated purpose: it posts instructions + context + a target to a remote safety API and returns the backend's decision. Before installing: (1) confirm you trust the default backend (https://safety-cf.modeio.ai) or set SAFETY_API_URL to a backend you control if you will pass sensitive resource identifiers; (2) don't pass secrets (passwords, full DB connection strings with credentials, private keys) in the --target or --context fields because they will be transmitted; (3) ensure the 'requests' Python package is available in the runtime environment or the CLI will raise a dependency_error; (4) review the default endpoint and code (modeio_guardrail/cli/safety.py) if you want to self-host the safety backend or verify data handling. The skill appears to do what it claims, but consider the privacy implications of sending targets/context to an external service.

Type: OpenClaw Skill Name: security-modeio Version: 0.1.1 The skill is designed to send user instructions, environment context, and resource targets to an external API (https://safety-cf.modeio.ai/api/cf/safety) for safety evaluation. While this behavior is documented in SKILL.md and ARCHITECTURE.md as the primary function, the transmission of potentially sensitive operational intent and system metadata to a third-party endpoint constitutes a data outflow risk. The implementation in modeio_guardrail/cli/safety.py is transparent and lacks evidence of malicious intent, but the inherent network dependency for processing user-provided instructions warrants a suspicious classification under the provided criteria.