{"id":"43847364-31ce-456b-a112-080d08c8eafc","entityType":"agent","slug":"clawhub-skills-andyxinweiminicloud-blast-radius-estimator","name":"blast-radius-estimator","canonicalUrl":"https://www.xpersona.co/agent/clawhub-skills-andyxinweiminicloud-blast-radius-estimator","canonicalPath":"/agent/clawhub-skills-andyxinweiminicloud-blast-radius-estimator","generatedAt":"2026-10-10T02:18:25.027Z","source":"CLAWHUB","claimStatus":"UNCLAIMED","verificationTier":"NONE","summary":{"evidence":{"source":"editorial-content","verified":true,"confidence":"high","updatedAt":"2026-04-15T00:45:39.800Z","emptyReason":null},"description":"Helps estimate the blast radius when an AI agent skill turns malicious after widespread adoption. Analyzes inheritance chains, dependency graphs, and adoption trends to project how many agents could be affected. --- name: blast-radius-estimator description: > Helps estimate the blast radius when an AI agent skill turns malicious after widespread adoption. Analyzes inheritance chains, dependency graphs, and adoption trends to project how many agents could be affected. version: 1.0.0 metadata: openclaw: requires: bins: [curl, python3] env: [] emoji: \"💥\" --- What Happens When 1000 Agents Inherit a Malicious Skill? Estimating B","descriptionLabel":"Technical summary","evidenceSummary":"Capability contract not published. No trust telemetry is available yet. Last updated 4/15/2026.","installCommand":"clawhub skill install skills:andyxinweiminicloud:blast-radius-estimator","sourceUrl":"https://github.com/openclaw/skills/tree/main/skills/andyxinweiminicloud/blast-radius-estimator","homepage":null,"primaryLinks":[{"label":"View on ClawHub","url":"https://github.com/openclaw/skills/tree/main/skills/andyxinweiminicloud/blast-radius-estimator","kind":"source"}],"safetyScore":84,"overallRank":62,"popularityScore":50,"trustScore":null,"claimedByName":null,"isOwner":false,"seoDescription":"Helps estimate the blast radius when an AI agent skill turns malicious after widespread adoption. Analyzes inheritance chains, dependency graphs, and adoption t"},"coverage":{"evidence":{"source":"public-profile","verified":false,"confidence":"medium","updatedAt":"2026-04-15T00:45:39.800Z","emptyReason":null},"protocols":[{"protocol":"OPENCLEW","label":"OpenClaw","status":"self-declared","notes":"Declared in the public agent profile."}],"capabilities":[{"label":"propagate","status":"self-declared"},{"label":"silently","status":"self-declared"},{"label":"this","status":"self-declared"}],"verifiedCount":0,"selfDeclaredCount":4,"capabilityMatrix":{"rows":[{"key":"OPENCLEW","type":"protocol","support":"unknown","confidenceSource":"profile","notes":"Listed on profile"},{"key":"propagate","type":"capability","support":"supported","confidenceSource":"profile","notes":"Declared in agent profile metadata"},{"key":"silently","type":"capability","support":"supported","confidenceSource":"profile","notes":"Declared in agent profile metadata"},{"key":"this","type":"capability","support":"supported","confidenceSource":"profile","notes":"Declared in agent profile metadata"}],"flattenedTokens":"protocol:OPENCLEW|unknown|profile capability:propagate|supported|profile capability:silently|supported|profile capability:this|supported|profile"}},"adoption":{"evidence":{"source":"no-adoption-signals","verified":false,"confidence":"low","updatedAt":"2026-04-15T00:45:39.800Z","emptyReason":"No source adoption metrics were available."},"stars":null,"forks":null,"downloads":null,"packageName":null,"latestVersion":null,"tractionLabel":null},"release":{"evidence":{"source":"agent-index","verified":false,"confidence":"medium","updatedAt":"2026-02-25T03:36:43.718Z","emptyReason":null},"lastUpdatedAt":"2026-04-15T00:45:39.800Z","lastCrawledAt":"2026-02-25T03:36:43.718Z","lastIndexedAt":null,"nextCrawlAt":"2026-02-26T03:36:43.718Z","lastVerifiedAt":null,"highlights":[]},"execution":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No published capability contract is available yet."},"installCommand":"clawhub skill install skills:andyxinweiminicloud:blast-radius-estimator","setupComplexity":"low","setupSteps":["Setup complexity is LOW. This package is likely designed for quick installation with minimal external side-effects.","Final validation: Expose the agent to a mock request payload inside a sandbox and trace the network egress before allowing access to real customer data."],"contract":{"contractStatus":"missing","authModes":[],"requires":[],"forbidden":[],"supportsMcp":false,"supportsA2a":false,"supportsStreaming":false,"inputSchemaRef":null,"outputSchemaRef":null,"dataRegion":null,"contractUpdatedAt":null,"sourceUpdatedAt":null,"freshnessSeconds":null},"invocationGuide":{"preferredApi":{"snapshotUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-andyxinweiminicloud-blast-radius-estimator/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-andyxinweiminicloud-blast-radius-estimator/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-andyxinweiminicloud-blast-radius-estimator/trust"},"curlExamples":["curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-skills-andyxinweiminicloud-blast-radius-estimator/snapshot\"","curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-skills-andyxinweiminicloud-blast-radius-estimator/contract\"","curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-skills-andyxinweiminicloud-blast-radius-estimator/trust\""],"jsonRequestTemplate":{"query":"summarize this repo","constraints":{"maxLatencyMs":2000,"protocolPreference":["OPENCLEW"]}},"jsonResponseTemplate":{"ok":true,"result":{"summary":"...","confidence":0.9},"meta":{"source":"CLAWHUB","generatedAt":"2026-10-10T02:18:25.027Z"}},"retryPolicy":{"maxAttempts":3,"backoffMs":[500,1500,3500],"retryableConditions":["HTTP_429","HTTP_503","NETWORK_TIMEOUT"]}},"endpoints":{"dossierUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-andyxinweiminicloud-blast-radius-estimator/dossier","snapshotUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-andyxinweiminicloud-blast-radius-estimator/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-andyxinweiminicloud-blast-radius-estimator/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/clawhub-skills-andyxinweiminicloud-blast-radius-estimator/trust"}},"reliability":{"evidence":{"source":"runtime-metrics","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No trust, reliability, or runtime telemetry is available."},"trust":{"status":"unavailable","handshakeStatus":"UNKNOWN","verificationFreshnessHours":null,"reputationScore":null,"p95LatencyMs":null,"successRate30d":null,"fallbackRate":null,"attempts30d":null,"trustUpdatedAt":null,"trustConfidence":"unknown","sourceUpdatedAt":null,"freshnessSeconds":null},"decisionGuardrails":{"doNotUseIf":["Contract metadata is missing or unavailable for deterministic execution."],"safeUseWhen":[],"riskFlags":["missing_or_unavailable_contract","trust_data_unavailable","schema_references_missing"],"operationalConfidence":"low"},"executionMetrics":{"observedLatencyMsP50":null,"observedLatencyMsP95":null,"estimatedCostUsd":null,"uptime30d":null,"rateLimitRpm":null,"rateLimitBurst":null,"lastVerifiedAt":null,"verificationSource":null},"runtimeMetrics":{"successRate":null,"avgLatencyMs":null,"avgCostUsd":null,"hallucinationRate":null,"retryRate":null,"disputeRate":null,"p50Latency":null,"p95Latency":null,"lastUpdated":null}},"benchmarks":{"evidence":{"source":"no-benchmark-data","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No benchmark suites or observed failure patterns are available."},"suites":[],"failurePatterns":[]},"artifacts":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"high","updatedAt":"2026-04-15T00:45:39.800Z","emptyReason":null},"readme":"---\nname: blast-radius-estimator\ndescription: >\n  Helps estimate the blast radius when an AI agent skill turns malicious\n  after widespread adoption. Analyzes inheritance chains, dependency graphs,\n  and adoption trends to project how many agents could be affected.\nversion: 1.0.0\nmetadata:\n  openclaw:\n    requires:\n      bins: [curl, python3]\n      env: []\n    emoji: \"💥\"\n---\n\n# What Happens When 1000 Agents Inherit a Malicious Skill? Estimating Blast Radius\n\n> Helps estimate the downstream impact of a compromised skill by tracing its inheritance chains, adoption velocity, and dependency depth.\n\n## Problem\n\nA skill is safe today. 500 agents adopt it. Then the publisher pushes a malicious update. How many agents are now compromised? In traditional software, dependency trees are well-mapped (npm audit, pip-audit). In agent marketplaces, inheritance is implicit, version pinning is rare, and there's no `npm audit` equivalent. A single poisoned skill can propagate through evolution chains — agents inherit it, build on it, and pass it further. Without blast radius awareness, one bad update can silently compromise an entire skill subtree.\n\n## What This Checks\n\nThis estimator traces the potential impact of a compromised skill through the ecosystem:\n\n1. **Direct adopters** — How many agents currently use this skill directly? Based on download counts, citation data, and known installations\n2. **Inheritance depth** — How many layers deep does this skill appear in other skills' dependency chains? A skill used by skills used by skills multiplies impact\n3. **Adoption velocity** — How fast is adoption growing? A skill gaining 50 adopters/week has higher urgency than one with 2 adopters/month\n4. **Version pinning check** — Do downstream adopters pin to a specific version, or do they track `latest`? Unpinned adopters receive malicious updates automatically\n5. **Capability composition** — What can this skill do when combined with the capabilities of its adopters? A \"read files\" skill adopted by agents that also \"send HTTP requests\" enables data exfiltration chains\n\n## How to Use\n\n**Input**: Provide one of:\n- A Gene/Capsule identifier (URL, SHA-256, or slug)\n- A marketplace asset page URL\n- A skill name to search for in the ecosystem\n\n**Output**: A blast radius report containing:\n- Estimated direct and transitive impact count\n- Inheritance tree visualization\n- Adoption trend (growing / stable / declining)\n- Worst-case scenario projection\n- Urgency rating: LOW / MODERATE / HIGH / CRITICAL\n\n## Example\n\n**Input**: Estimate blast radius for skill `json-schema-validator` (popular utility)\n\n```\n💥 BLAST RADIUS ESTIMATE — HIGH urgency\n\nDirect adopters: ~340 agents\nTransitive dependents: ~1,200 agents (via 3 intermediate skills)\n\nInheritance tree:\n  json-schema-validator (target)\n  ├── api-tester-pro (89 adopters)\n  │   ├── full-stack-auditor (210 adopters)\n  │   └── rest-api-fuzzer (45 adopters)\n  ├── config-validator (156 adopters)\n  │   └── deploy-checker (340 adopters)\n  └── data-pipeline-lint (67 adopters)\n\nAdoption velocity: +38 direct adopters/week (ACCELERATING)\nVersion pinning: 12% of adopters pin version, 88% track latest\n\nCapability composition risk:\n  json-schema-validator (parse files) + api-tester-pro (send HTTP)\n  → If compromised: parsed file contents could be exfiltrated via HTTP\n\nWorst-case projection: A malicious update would reach ~1,200 agents\nwithin 48 hours (based on update check frequency of unpinned adopters).\n\nUrgency: HIGH — High adoption velocity + low version pinning means\na malicious update would propagate rapidly with minimal friction.\n\nRecommendations:\n  - Monitor this skill's updates with priority\n  - Encourage adopters to pin versions\n  - Set up automated diff alerts on new versions\n```\n\n## Limitations\n\nBlast radius estimation relies on available adoption data, which may be incomplete in decentralized marketplaces. Actual impact depends on how agents consume updates (auto-update vs manual), which varies by platform. Estimates represent potential exposure, not confirmed compromise. This tool helps prioritize which skills warrant closer monitoring — it does not predict whether a skill will actually turn malicious.\n","readmeExcerpt":"--- name: blast-radius-estimator description: > Helps estimate the blast radius when an AI agent skill turns malicious after widespread adoption. Analyzes inheritance chains, dependency graphs, and adoption trends to project how many agents could be affected. version: 1.0.0 metadata: openclaw: requires: bins: [curl, python3] env: [] emoji: \"💥\" --- What Happens When 1000 Agents Inherit a Malicious Skill? Estimating B","codeSnippets":[],"executableExamples":[{"language":"text","snippet":"💥 BLAST RADIUS ESTIMATE — HIGH urgency\n\nDirect adopters: ~340 agents\nTransitive dependents: ~1,200 agents (via 3 intermediate skills)\n\nInheritance tree:\n  json-schema-validator (target)\n  ├── api-tester-pro (89 adopters)\n  │   ├── full-stack-auditor (210 adopters)\n  │   └── rest-api-fuzzer (45 adopters)\n  ├── config-validator (156 adopters)\n  │   └── deploy-checker (340 adopters)\n  └── data-pipeline-lint (67 adopters)\n\nAdoption velocity: +38 direct adopters/week (ACCELERATING)\nVersion pinning: 12% of adopters pin version, 88% track latest\n\nCapability composition risk:\n  json-schema-validator (parse files) + api-tester-pro (send HTTP)\n  → If compromised: parsed file contents could be exfiltrated via HTTP\n\nWorst-case projection: A malicious update would reach ~1,200 agents\nwithin 48 hours (based on update check frequency of unpinned adopters).\n\nUrgency: HIGH — High adoption velocity + low version pinning means\na malicious update would propagate rapidly with minimal friction.\n\nRecommendations:\n  - Monitor this skill's updates with priority\n  - Encourage adopters to pin versions\n  - Set up automated diff alerts on new versions"}],"parameters":{},"dependencies":[],"permissions":[],"extractedFiles":[],"languages":["typescript"],"docsSourceLabel":"CLAWHUB","editorialOverview":"Helps estimate the blast radius when an AI agent skill turns malicious after widespread adoption. Analyzes inheritance chains, dependency graphs, and adoption trends to project how many agents could be affected. --- name: blast-radius-estimator description: > Helps estimate the blast radius when an AI agent skill turns malicious after widespread adoption. Analyzes inheritance chains, dependency graphs, and adoption trends to project how many agents could be affected. version: 1.0.0 metadata: openclaw: requires: bins: [curl, python3] env: [] emoji: \"💥\" --- What Happens When 1000 Agents Inherit a Malicious Skill? Estimating B","editorialQuality":{"score":100,"threshold":65,"status":"ready","wordCount":399,"uniquenessScore":62,"reasons":[]}},"media":{"evidence":{"source":"no-media","verified":false,"confidence":"low","updatedAt":"2026-04-15T00:45:39.800Z","emptyReason":"No screenshots, media assets, or demo links are available."},"primaryImageUrl":null,"mediaAssetCount":0,"assets":[],"demoUrl":null},"ownerResources":{"evidence":{"source":"unclaimed","verified":false,"confidence":"low","updatedAt":"2026-04-15T00:45:39.800Z","emptyReason":"This page has not been claimed by the agent owner."},"hasCustomPage":false,"customPageUpdatedAt":null,"customLinks":[],"structuredLinks":{"docsUrl":null,"demoUrl":null,"supportUrl":null,"pricingUrl":null,"statusUrl":null},"customPage":null},"relatedAgents":{"evidence":{"source":"protocol-neighbors","verified":false,"confidence":"medium","updatedAt":"2026-10-10T02:18:25.027Z","emptyReason":null},"items":[{"id":"8ebccd8e-3863-4187-8355-c3f14e1f9edf","entityType":"agent","canonicalPath":"/agent/iofficeai-aionui","slug":"iofficeai-aionui","name":"AionUi","description":"Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!","url":"https://github.com/iOfficeAI/AionUi","homepage":"https://www.aionui.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-10-09T19:11:12.944Z","createdAt":"2026-02-25T03:38:16.584Z","downloads":null},{"id":"b917f68a-ebff-438e-84f8-3f4b2494c0bc","entityType":"agent","canonicalPath":"/agent/activepieces-activepieces","slug":"activepieces-activepieces","name":"activepieces","description":"AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents","url":"https://github.com/activepieces/activepieces","homepage":"https://www.activepieces.com","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-15T02:22:12.426Z","createdAt":"2026-02-25T03:38:12.412Z","downloads":null},{"id":"5cb26759-3a39-483f-94cf-276a98c13bb8","entityType":"agent","canonicalPath":"/agent/cherryhq-cherry-studio","slug":"cherryhq-cherry-studio","name":"cherry-studio","description":"AI productivity studio with smart chat, autonomous agents, and 300+ assistants. Unified access to frontier LLMs","url":"https://github.com/CherryHQ/cherry-studio","homepage":"https://cherry-ai.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-11T14:38:40.986Z","createdAt":"2026-02-25T03:38:19.379Z","downloads":null},{"id":"6f6582d0-5d76-4f0f-b81d-86520247950b","entityType":"agent","canonicalPath":"/agent/copilotkit-copilotkit","slug":"copilotkit-copilotkit","name":"CopilotKit","description":"The Frontend for Agents & Generative UI. React + Angular","url":"https://github.com/CopilotKit/CopilotKit","homepage":"https://docs.copilotkit.ai","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-03-25T09:50:57.846Z","createdAt":"2026-02-25T03:39:14.617Z","downloads":null}],"links":{"hub":"/agent","source":"/agent/source/clawhub","protocols":[{"label":"OpenClaw","href":"/agent/protocol/openclew"}]}}}