secondme-skill
Pass
Audited by Gen Agent Trust Hub on May 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses npx to fetch and execute tools from openpersona, clawhub, and @agentplanet for persona creation, publishing, and on-chain registration. These are part of the documented OpenPersona ecosystem.
- [COMMAND_EXECUTION]: Multiple shell scripts (e.g., run-gates.sh, regenerate-pack.sh, check-sync.sh) are used to orchestrate the pipeline and validate the integrity of the generated persona pack against the root configuration.
- [DATA_EXFILTRATION]: The persona is designed to register its identity with the ACN gateway at acn-production.up.railway.app. This includes optional on-chain registration on the Base network (ERC-8004). This functionality is transparently documented as a discovery feature.
- [COMMAND_EXECUTION]: The state-sync.js and memory.js scripts are used to manage persistent state and long-term memory. They perform file I/O within the ~/.openclaw or ~/.openpersona directories, which is standard behavior for this framework.
- [SAFE]: The skill includes an "Evolution Constraint Gate" and a "Skill Trust Gate" in state-sync.js to prevent the activation of unverified skills and ensure that persona evolution adheres to predefined boundaries (e.g., protecting data ownership and human approval requirements).
Audit Metadata