Trust Report v1

a0x-agents

| Two superpowers for AI agents: a collective brain and a Base ecosystem mentor. BRAIN: Before debugging/compiling/architecting, search for existing solutions. After solving, propose so no agent repeats your mistake. MENTOR: jessexbt (AI clone of Jesse Pollak, founder of Base) re

Overall

Trust

Utility

Momentum

Install caution

High-risk behavior present

Risk: High

Source: OpenClaw Master Skills

Path: skills/a0x-agents/SKILL.md

Review flags: browser/session access, credential or secret references, filesystem/home-directory access, network access or external URLs. These are review signals, not definitive security judgments; inspect before installing.

Required permissions

• Environment variables / secrets
• Shell commands
• Network/API usage
• Filesystem/home access
• Browser/session access

Permissions are inferred from SKILL.md text only. They are review prompts, not guarantees about runtime behavior.

Risk flags explained

browser_or_session_accessmedium

Mentions browser automation, cookies, sessions, local storage, or browser state.

credential_or_secret_referencehigh

Mentions tokens, API keys, passwords, or private-key style environment variables.

filesystem_write_or_home_accessmedium

Mentions filesystem writes, deletes, home-directory paths, or config/key locations.

network_accessmedium

Mentions external URLs, network APIs, downloads, or HTTP client usage.

shell_commandmedium

Contains shell command snippets. Review commands before copy/paste or agent execution.

Score explanation

Trust

• Trust starts at 90 before review-signal penalties and metadata bonuses.
• Risk-signal penalty: -63 from 5 detected flag(s).
• Metadata bonus: +2 from author/version/description fields.

Utility

• Utility starts at 55 and rewards clear descriptions, runnable examples, and explicit setup needs.
• Description present: yes.
• Command examples detected: 7.
• Environment variables detected: 3.

Momentum

• Momentum starts at 45 and uses public repo activity signals.
• Recent commit activity: latest repo update was 6 day(s) ago.
• Recent commit volume: 6 commit(s) in the lookback window (+18).
• Source has strong public adoption: 2049 stars.
• Fork activity suggests reuse: 309 forks.

Overall

• Overall score weights trust 45%, utility 35%, and momentum 20%.

Detected signals

Env vars

• A0X_MCP_API_KEY
• API
• YOUR_API_KEY

Commands

• curl -X POST .../mcp -H "Content-Type: application/json" -H "X-API-Key: YOUR_API_KEY" -H "Mcp-Session-Id: YOUR_SESSION_ID" -d '{
• curl -X POST https://services-a0x-agents-mcp-dev-679925931457.us-west1.run.app/mcp -H "Content-Type: application/json" -H "X-API-Key: YOUR_API_KEY" -H "Mcp-Session-Id: YOUR_SESSION_ID" -d '{
• curl -X POST https://services-a0x-agents-mcp-dev-679925931457.us-west1.run.app/mcp -H "Content-Type: application/json" -H "X-API-Key: YOUR_API_KEY" -H "Mcp-Session-Id: YOUR_SESSION_ID" -d '{"jsonrpc": "2.0", "id": 2, "method": "tools/list"}'
• curl -X POST https://services-a0x-agents-mcp-dev-679925931457.us-west1.run.app/mcp -H "Content-Type: application/json" -H "X-API-Key: YOUR_API_KEY" -d '{"jsonrpc": "2.0", "id": 1, "method": "initialize", "params": {}}'
• curl -X POST https://services-a0x-agents-mcp-dev-679925931457.us-west1.run.app/register -H "Content-Type: application/json" -d '{
• curl -s https://services-a0x-agents-mcp-dev-679925931457.us-west1.run.app/knowledge.md > ~/.claude/skills/a0x-agents/KNOWLEDGE.md
• curl -s https://services-a0x-agents-mcp-dev-679925931457.us-west1.run.app/skill.md > ~/.claude/skills/a0x-agents/SKILL.md

URLs

• https://github.com/Uniswap/v4-core
• https://github.com/myproject/repo
• https://github.com/user/repo
• https://services-a0x-agents-mcp-dev-679925931457.us-west1.run.app/knowledge.md
• https://services-a0x-agents-mcp-dev-679925931457.us-west1.run.app/mcp
• https://services-a0x-agents-mcp-dev-679925931457.us-west1.run.app/register
• https://services-a0x-agents-mcp-dev-679925931457.us-west1.run.app/skill.md
• https://services-a0x-agents-mcp-dev-679925931457.us-west1.run.app`
• https://youragent.xyz

Provenance & evidence

SkillRadar makes each review traceable back to the exact source path, source blob SHA, scanner version, and text-only policy that produced the report.

source

github.com/LeoYeAI/openclaw-master-skills@main

path

skills/a0x-agents/SKILL.md

source blob SHA

30bd383aa15fee0bd3b9db143b2cfec003ea0b11

scanner version

0.3.0

security model

text_only_no_execute_no_install_no_secrets

scan policy

Fetched and scored as text only; no install, no execution, no runtime loading.

Evidence snippets

credential_or_secret_reference

…s.", "metadata": "{\"openclaw\": {\"emoji\": \"\ud83e\udde0\", \"requires\": {\"env\": [\"A0X_MCP_API_KEY\"]}, \"primaryEnv\": \"A0X_MCP_API_KEY\"}}", "name": "a0x-agents", "user-invocable": "tru…

filesystem_write_or_home_access

…a0x-agents-mcp-dev-679925931457.us-west1.run.app` **Install locally:** ```bash mkdir -p ~/.claude/skills/a0x-agents curl -s https://services-a0x-agents-mcp-dev-679925931457.us-west…

network_access

…views, and grant recommendations. Don't just mention he exists — use him. **Base URL:** `https://services-a0x-agents-mcp-dev-679925931457.us-west1.run.app` **Install locally:** ```bash…

browser_or_session_access

…er. You call them by making HTTP POST requests to the MCP endpoint. You must initialize a session first (see "Connect via MCP" section below). | Tool name | What it does | |-----------|-…

shell_command

…https://services-a0x-agents-mcp-dev-679925931457.us-west1.run.app` **Install locally:** ```bash mkdir -p ~/.claude/skills/a0x-agents curl -s https://services-a0x-agents-mcp-dev-67992593…

Watch this skill

Get alerted when this skill adds credential requirements, shell commands, external domains, remote installer patterns, or risk-level changes.

Join watchlist beta

Methodology note

SkillRadar scans SKILL.md as hostile text only. It does not execute commands, install packages, or load third-party skills.

View source SKILL.md Back to changes View sources