Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Botlearn Doctor@1.0.2
v1.0.0Autonomously inspects a live OpenClaw instance across 5 health domains (hardware, config, security, skills, autonomy) and delivers a quantified traffic-light...
⭐ 0· 56·1 current·1 all-time
by@1215656
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description (OpenClaw health doctor) match the actual behavior: scripts and SKILL.md collect config, logs, runtime status, skills, and perform local CLI checks. Required binaries (node, bash, curl) and primaryEnv OPENCLAW_HOME are appropriate for this task. The optional requirement of clawhub/openclaw is expected.
Instruction Scope
The SKILL.md mandates autonomous collection of many local artifacts (config, logs, heartbeat, workspace identity files' content, cron jobs, openclaw doctor output). This is consistent with a deep health check, but it is privacy-sensitive: it reads workspace identity files and configuration files and runs local CLI commands without user prompts. The documentation claims redaction rules (e.g., gateway.err.log) and not to echo raw identity content in reports, but the code does collect raw content into DATA.workspace_identity for analysis — so the agent must be trusted to obey the redaction/non-echo rules when producing outward reports.
Install Mechanism
No install spec — the skill is instruction-only with shipped scripts. No remote downloads, package installs, or extract steps are performed by an installer, lowering supply-chain risk.
Credentials
The skill declares a single primaryEnv (OPENCLAW_HOME) and needs local CLIs; it does not request unrelated secrets or multiple credentials. However, it reads many files under OPENCLAW_HOME (configs, logs, workspace identity files) that can contain PII or credentials; the SKILL.md prescribes redaction for some logs but the scripts capture raw content into DATA structures for internal analysis.
Persistence & Privilege
The skill is not always-on and does not request elevated platform privileges. It runs local read/inspection commands and may call available CLIs (openclaw, clawhub) if present. It does provide 'fix hints' that suggest installing other skills (including with --force), but those are recommendations rather than automatic install steps in the provided code.
Assessment
This skill appears to do exactly what it says: run a deep local health check of an OpenClaw instance by reading config, logs, cron entries, workspace files, and running local openclaw/clawhub commands. Before installing or running it, consider: (1) it will autonomously execute the included scripts and run local commands — only install on hosts you trust; (2) it reads workspace identity files and other potentially personal data into its analysis context (the author intends redaction, but the agent must be trusted not to leak raw content); (3) it can invoke clawhub/openclaw if present and may surface commands that, if executed, install skills (the SKILL.md suggests using --force for botlearn packages); (4) review the shipped scripts (listed in the manifest) to confirm you are comfortable with the exact files read and commands run; (5) run the skill first in a staging environment or with OPENCLAW_HOME pointed at a copy of your instance if you want to avoid exposing production data. Overall the package is coherent with its purpose, but exercise normal caution around PII and automated install recommendations.scripts/collect-security.sh:48
Shell command execution detected (child_process).
scripts/collect-tools.sh:44
Shell command execution detected (child_process).
scripts/deliver-report.sh:118
Shell command execution detected (child_process).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.Like a lobster shell, security has layers — review code before you run it.
latestvk97ddxay3fh3e9heyw9m4wc4nd83j3hq
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🏥 Clawdis
OSmacOS · Linux
Binscurl, node, bash
Any binclawhub, openclaw
Primary envOPENCLAW_HOME