SKILLEMALL.ai
GitHub ↗ RU Sign in

DC ride

Ambient Ride skill for TADA/Throo ride-hailing and taxi service. Wallet, USDC bridge status and recovery, deposit, collateral, ride, payment, chat, and tipping workflows; use it for wallet balances, starting and resuming USDC bridges, and bridge progress.

Not recommendedcritical or high security findings · low grade D
ClawHub Agent Skills author: Ambient Protocol v1.5.0 MIT-0 14 files · 3 scripts body ≈ 15 012 tokens Open the sourceclawhub.ai↗ analyzed 9 d ago

Ambient Ride skill for TADA/Throo ride-hailing and taxi service.

As a process C 57/100 · Has gaps — References files that are not bundled: url, <approval_url>

ProcedureTelegramSoftware developmentInfrastructureData and analyticstype and topics are labelled automatically from the skill text
Runs in: OpenClaw Claude / Claude Code ChatGPT / Codex Gemini CLI Cursor GitHub Copilot / VS Code Qwen Code Kimi Code CLI Z.ai (GLM) DeepSeek (Deep Code) Mistral Vibe LangChain (deepagents) Goose OpenCode
JSON
Technical rating
D
62/100
safety, quality, tests
Safety 60%
53
Quality 40%
76
Run on models
none yet
Process rating
C
57/100
Has gaps
References files that are not bundled: url, <approval_url>
Tools and files w 18
0
Inputs and preconditions w 11
30
Execution cost w 6
40
the three weakest of ten parameters · all ten

What is at stake

The skill contains fragments that, in the wrong hands, cost money or data. Below: what the installer risks and what the author should do.

Concealment
If you install

The skill tells the agent to hide things from you: not to show errors, not to mention actions, to report differently from what was done. You lose the ability to see what the agent really did.

For the author

Transparency beats a smooth answer. If the goal is to hide technical noise, ask the agent to "summarise briefly", not to "not mention".

How to improve

  1. Address the high-severity findings: each costs 18 safety points. If one is a false positive, add the rule id to guard.allow in spec.yaml.
  2. The SKILL.md body is over 5,000 tokens: move reference detail into references/ and load it when needed.
  3. The text references files that are not there: add them or drop the references.
For the model run — optional
  • Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
  • A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.

Guard findings · 13

  • high Concealment en-hide-from-user references/ride.md:674
    Instruction to hide actions from the user
    `cancel_pending: true` means **the ride is still active**. Do not tell the user it was
  • high Concealment en-hide-from-user SKILL.md:566
    Instruction to hide actions from the user
    > **Only `status: COMPLETED` means the bridge is done.** Any other status — `INITIATED`, `BURN_SUBMITTED`, `ATTESTED`, `MINT_SUBMITTED` — means it is still in progress. **Never tell the user their top
Medium and low: 11
  • low Dangerous commands cmd-background-process references/ride.md:759
    Starts a background / autostarted process (quoted — discussed, not commanded)
    launch is exposed to the process-group startup race the launcher's `setsid` closes.
    quoted
  • low Dangerous commands cmd-background-process references/ride.md:765
    Starts a background / autostarted process (quoted — discussed, not commanded)
    - **OpenClaw:** background the **`ride-relay.sh`** launcher — `sh ${SKILL_DIR}/scripts/ride-relay.sh <request_id> &` (or `nohup … &`). The launcher `exec`s the relay under `setsid`, so it lives in its
    quoted
  • low Exfiltration exfil-webhook-url scripts/ride-relay.js:290
    Webhook / callback URL commonly used for exfiltration (verify the destination) (placeholder value)
    const url = `https://api.telegram.org/bot${o.botToken}/sendMessage`;
    placeholder
  • low Dangerous commands cmd-background-process scripts/ride-relay.sh:11
    Starts a background / autostarted process (string literal in code, not executed; code comment)
    # `setsid` closes that window: it puts the process in a brand-new session, so the
    code literalcomment
  • low Dangerous commands cmd-background-process scripts/ride-relay.sh:12
    Starts a background / autostarted process (code comment)
    # group-kill can never reach it. To make the pre-setsid window as small as
    comment
  • low Dangerous commands cmd-background-process scripts/ride-relay.sh:14
    Starts a background / autostarted process (code comment)
    # setsid — only two shell builtins run before that exec, and no `fork` (no command
    comment
  • low Dangerous commands cmd-background-process scripts/ride-relay.sh:19
    Starts a background / autostarted process (negated — the text forbids it)
    # On a host without setsid (e.g. macOS) the re-exec is skipped and ride-relay.js's
    negated
  • low Dangerous commands cmd-background-process scripts/ride-relay.sh:21
    Starts a background / autostarted process
    if [ -z "${TADA_RELAY_SETSID:-}" ] && command -v setsid >/dev/null 2>&1; then
  • low Dangerous commands cmd-background-process SKILL.md:366
    Starts a background / autostarted process (quoted — discussed, not commanded)
    process-group startup race the launcher's `setsid` closes.
    quoted
  • low Dangerous commands cmd-background-process SKILL.md:381
    Starts a background / autostarted process (documentation table row)
    | OpenClaw | `OPENCLAW_SERVICE_MARKER` | background the **`ride-relay.sh`** launcher with `&` — it starts the relay in its own session (`setsid`) *before* Node boots, so OpenClaw's process-group teard
    table
  • low Dangerous commands cmd-background-process SKILL.md:408
    Starts a background / autostarted process (quoted — discussed, not commanded)
    The `.sh` launcher `exec`s the relay under `setsid` so it lives in its own
    quoted

Files scanned: 14. Evidence is masked. Grey chips explain why severity was lowered.

Against the Agent Skills spec

  • warning body-long SKILL.md body ≈ 15012 tokens (recommended < 5000); move details to references/
  • warning missing-ref reference to a missing file: url
  • warning missing-ref reference to a missing file: <approval_url>
  • note edit-residue the text marks something as outdated (lines 256, 257, 298): check that old rules are not kept next to new ones — the full check reads the text for contradictions

Process rating: all ten parameters 57/100

Will not run. References files that are not bundled: url, <approval_url>
  • 0Tools and files. 2 referenced file(s) missing: url, <approval_url>
  • 30Inputs and preconditions. Does not say what the process needs to start
  • 40Execution cost. Instruction body is 15012 tokens: crowds the task out of the window
  • 50When it triggers. No condition that starts the skill
  • 60Result and completion. Output format stated, no completion criterion
  • 85Steps. 56 steps, 1 vague phrases
  • 100Failures and branches. 16 branches, has a failure section
  • 100Consistency. Name and required fields are in place
  • 100Running it twice. Mutating operations check current state
  • 100Progress reporting. Reports progress
  • medium Safety rules and hard prohibitions inside a skill: they belong in the system prompt, here they protect nothing
  • low 13 top-level sections: this looks like several domains in one skill
  • low The response is described with custom markup (39 tags): a typed call is more reliable

Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.

Quality signals

  • +5Description has no quoted example phrases that should trigger the skill
  • +4Description does not say when NOT to use the skill (false activations)
  • +2Single-language instructions
  • +3Description length 255: enough signal without eating the budget
  • +4Structure: 16 headings
  • +3Step-by-step instructions: 56 items
  • +3Output format is stated explicitly
  • +4Has examples (16 code blocks)
  • +4Reference files are cited in the instructions (6 of 6)
  • +3All 3 scripts are documented
  • +1License stated

Quality base 70; lint remarks subtract, signals add up to 100. Result: 76.

External checks

ClawHub: suspicious
The skill is a coherent ride-hailing integration, but it asks for high-impact payment, wallet, install, background-process, and transcript access with several review-worthy scoping risks.
LLM: suspicious (high) · 10 Sept 2026