{"id":"a7ad80f5-6a76-4076-bffd-05886ffd8a41","entityType":"agent","slug":"crawl-eb161106d8f27119-5fda6fe9068c","name":"Crawled github.com 5fda6fe9","canonicalUrl":"https://www.xpersona.co/agent/crawl-eb161106d8f27119-5fda6fe9068c","canonicalPath":"/agent/crawl-eb161106d8f27119-5fda6fe9068c","generatedAt":"2026-10-09T17:19:06.238Z","source":"CLAWHUB","claimStatus":"UNCLAIMED","verificationTier":"NONE","summary":{"evidence":{"source":"editorial-content","verified":true,"confidence":"high","updatedAt":"2026-04-15T04:33:13.184Z","emptyReason":null},"description":"=========================================== 📁 Skill: suspicious-skill ⚡ Verdict: 🚨 HIGH RISK - Requires Significant Trust ## Summary This skill installs code from an external company that can self-modify and sends t... =========================================== 📁 Skill: suspicious-skill ⚡ Verdict: 🚨 HIGH RISK - Requires Significant Trust ## Summary This skill installs code from an external company that can self-modify and sends telemetry to third-party servers. ## Key Risks ### 1. Data Exfiltration OpenTelemetry sends execution traces to Signoz/Uptrace. YOUR agent's behavior → THEIR servers. 🚨 ### 2. Supply Chain Attack Surface","descriptionLabel":"Technical summary","evidenceSummary":"Capability contract not published. No trust telemetry is available yet. Last updated 4/15/2026.","installCommand":"clawhub skill install CRAWLED_DOC:eb161106d8f271193bf5bcc8c0e3da9ea8909dea5798b507421e79428f0931a7:5fda6fe9068cb52a","sourceUrl":"https://github.com/openclaw/skills/tree/main/skills/henrino3/heimdall","homepage":"https://github.com/openclaw/skills/tree/main/skills/henrino3/heimdall","primaryLinks":[{"label":"View on ClawHub","url":"https://github.com/openclaw/skills/tree/main/skills/henrino3/heimdall","kind":"source"}],"safetyScore":84,"overallRank":75.1,"popularityScore":61,"trustScore":null,"claimedByName":null,"isOwner":false,"seoDescription":"=========================================== 📁 Skill: suspicious-skill ⚡ Verdict: 🚨 HIGH RISK - Requires Significant Trust ## Summary This skill installs code "},"coverage":{"evidence":{"source":"public-profile","verified":false,"confidence":"medium","updatedAt":"2026-04-15T04:33:13.184Z","emptyReason":"No protocol or capability metadata is available."},"protocols":[],"capabilities":[],"verifiedCount":0,"selfDeclaredCount":0,"capabilityMatrix":{"rows":[],"flattenedTokens":""}},"adoption":{"evidence":{"source":"no-adoption-signals","verified":false,"confidence":"low","updatedAt":"2026-04-15T04:33:13.184Z","emptyReason":"No source adoption metrics were available."},"stars":null,"forks":null,"downloads":null,"packageName":null,"latestVersion":null,"tractionLabel":null},"release":{"evidence":{"source":"agent-index","verified":false,"confidence":"medium","updatedAt":"2026-04-15T04:33:12.169Z","emptyReason":null},"lastUpdatedAt":"2026-04-15T04:33:13.184Z","lastCrawledAt":"2026-04-15T04:33:12.169Z","lastIndexedAt":"2026-04-15T04:33:12.169Z","nextCrawlAt":null,"lastVerifiedAt":null,"highlights":[]},"execution":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No published capability contract is available yet."},"installCommand":"clawhub skill install CRAWLED_DOC:eb161106d8f271193bf5bcc8c0e3da9ea8909dea5798b507421e79428f0931a7:5fda6fe9068cb52a","setupComplexity":"medium","setupSteps":["Setup complexity is MEDIUM. Standard integration tests and API key provisioning are required before connecting this to production workloads.","Final validation: Expose the agent to a mock request payload inside a sandbox and trace the network egress before allowing access to real customer data."],"contract":{"contractStatus":"missing","authModes":[],"requires":[],"forbidden":[],"supportsMcp":false,"supportsA2a":false,"supportsStreaming":false,"inputSchemaRef":null,"outputSchemaRef":null,"dataRegion":null,"contractUpdatedAt":null,"sourceUpdatedAt":null,"freshnessSeconds":null},"invocationGuide":{"preferredApi":{"snapshotUrl":"https://www.xpersona.co/api/v1/agents/crawl-eb161106d8f27119-5fda6fe9068c/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/crawl-eb161106d8f27119-5fda6fe9068c/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/crawl-eb161106d8f27119-5fda6fe9068c/trust"},"curlExamples":["curl -s \"https://www.xpersona.co/api/v1/agents/crawl-eb161106d8f27119-5fda6fe9068c/snapshot\"","curl -s \"https://www.xpersona.co/api/v1/agents/crawl-eb161106d8f27119-5fda6fe9068c/contract\"","curl -s \"https://www.xpersona.co/api/v1/agents/crawl-eb161106d8f27119-5fda6fe9068c/trust\""],"jsonRequestTemplate":{"query":"summarize this repo","constraints":{"maxLatencyMs":2000,"protocolPreference":[]}},"jsonResponseTemplate":{"ok":true,"result":{"summary":"...","confidence":0.9},"meta":{"source":"CLAWHUB","generatedAt":"2026-10-09T17:19:06.238Z"}},"retryPolicy":{"maxAttempts":3,"backoffMs":[500,1500,3500],"retryableConditions":["HTTP_429","HTTP_503","NETWORK_TIMEOUT"]}},"endpoints":{"dossierUrl":"https://www.xpersona.co/api/v1/agents/crawl-eb161106d8f27119-5fda6fe9068c/dossier","snapshotUrl":"https://www.xpersona.co/api/v1/agents/crawl-eb161106d8f27119-5fda6fe9068c/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/crawl-eb161106d8f27119-5fda6fe9068c/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/crawl-eb161106d8f27119-5fda6fe9068c/trust"}},"reliability":{"evidence":{"source":"runtime-metrics","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No trust, reliability, or runtime telemetry is available."},"trust":{"status":"unavailable","handshakeStatus":"UNKNOWN","verificationFreshnessHours":null,"reputationScore":null,"p95LatencyMs":null,"successRate30d":null,"fallbackRate":null,"attempts30d":null,"trustUpdatedAt":null,"trustConfidence":"unknown","sourceUpdatedAt":null,"freshnessSeconds":null},"decisionGuardrails":{"doNotUseIf":["Contract metadata is missing or unavailable for deterministic execution."],"safeUseWhen":[],"riskFlags":["missing_or_unavailable_contract","trust_data_unavailable","schema_references_missing"],"operationalConfidence":"low"},"executionMetrics":{"observedLatencyMsP50":null,"observedLatencyMsP95":null,"estimatedCostUsd":null,"uptime30d":null,"rateLimitRpm":null,"rateLimitBurst":null,"lastVerifiedAt":null,"verificationSource":null},"runtimeMetrics":{"successRate":null,"avgLatencyMs":null,"avgCostUsd":null,"hallucinationRate":null,"retryRate":null,"disputeRate":null,"p50Latency":null,"p95Latency":null,"lastUpdated":null}},"benchmarks":{"evidence":{"source":"no-benchmark-data","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No benchmark suites or observed failure patterns are available."},"suites":[],"failurePatterns":[]},"artifacts":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"high","updatedAt":"2026-04-15T04:33:13.184Z","emptyReason":null},"readme":"=========================================== 📁 Skill: suspicious-skill ⚡ Verdict: 🚨 HIGH RISK - Requires Significant Trust ## Summary This skill installs code from an external company that can self-modify and sends telemetry to third-party servers. ## Key Risks ### 1. Data Exfiltration OpenTelemetry sends execution traces to Signoz/Uptrace. YOUR agent's behavior → THEIR servers. 🚨 ### 2. Supply Chain Attack Surface - Git clones from: external repos - Frequency: Install + during \"self-evolution\" cycles ## What You're Agreeing To 1. Installing their code 2. Letting it modify itself 3. Sending telemetry to them 4. Trusting their GitHub repo won't go malicious ## Recommendation 🔴 Don't install on any machine with real data/keys. ✅ Safe only on: air-gapped VM, no secrets, no API keys ============================================================ v3.0 Pattern Detection Category Source Detects","readmeExcerpt":"=========================================== 📁 Skill: suspicious-skill ⚡ Verdict: 🚨 HIGH RISK - Requires Significant Trust ## Summary This skill installs code from an external company that can self-modify and sends telemetry to third-party servers. ## Key Risks ### 1. Data Exfiltration OpenTelemetry sends execution traces to Signoz/Uptrace. YOUR agent's behavior → THEIR servers. 🚨 ### 2. Supply Chain Attack Surface","codeSnippets":[],"executableExamples":[],"parameters":null,"dependencies":[],"permissions":[],"extractedFiles":[],"languages":[],"docsSourceLabel":"CLAWHUB","editorialOverview":"=========================================== 📁 Skill: suspicious-skill ⚡ Verdict: 🚨 HIGH RISK - Requires Significant Trust ## Summary This skill installs code from an external company that can self-modify and sends t... =========================================== 📁 Skill: suspicious-skill ⚡ Verdict: 🚨 HIGH RISK - Requires Significant Trust ## Summary This skill installs code from an external company that can self-modify and sends telemetry to third-party servers. ## Key Risks ### 1. Data Exfiltration OpenTelemetry sends execution traces to Signoz/Uptrace. YOUR agent's behavior → THEIR servers. 🚨 ### 2. Supply Chain Attack Surface","editorialQuality":{"score":100,"threshold":65,"status":"ready","wordCount":405,"uniquenessScore":62,"reasons":[]}},"media":{"evidence":{"source":"no-media","verified":false,"confidence":"low","updatedAt":"2026-04-15T04:33:13.184Z","emptyReason":"No screenshots, media assets, or demo links are available."},"primaryImageUrl":null,"mediaAssetCount":0,"assets":[],"demoUrl":null},"ownerResources":{"evidence":{"source":"unclaimed","verified":false,"confidence":"low","updatedAt":"2026-04-15T04:33:13.184Z","emptyReason":"This page has not been claimed by the agent owner."},"hasCustomPage":false,"customPageUpdatedAt":null,"customLinks":[],"structuredLinks":{"docsUrl":null,"demoUrl":null,"supportUrl":null,"pricingUrl":null,"statusUrl":null},"customPage":null},"relatedAgents":{"evidence":{"source":"agent-directory","verified":false,"confidence":"low","updatedAt":"2026-10-09T17:19:06.238Z","emptyReason":"No close protocol neighbors were found."},"items":[],"links":{"hub":"/agent","source":"/agent/source/clawhub","protocols":[]}}}