Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
1coos-quickie
v1.0.1Quickly save web content as formatted Markdown. TRIGGER when user pastes a URL and wants to save/clip it, read-later, or extract content from YouTube, Twitte...
⭐ 0· 65·0 current·0 all-time
by@1coos
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description, required binaries (bun to run the script and uvx to fetch/run x-reader), and the uv install entry for x-reader are coherent: the skill legitimately needs a runtime (bun) and a mechanism (uvx) to run the x-reader extractor it relies on.
Instruction Scope
SKILL.md confines actions to: check for uvx, run the included script with bun, and report/save the extracted Markdown. It does not request unrelated files or credentials. However, the runtime instruction intentionally fetches and executes x-reader from GitHub on each invocation — a significant behavior that goes beyond pure local processing and should be considered when evaluating safety.
Install Mechanism
The install spec uses 'uv' to install x-reader from git+https://github.com/runesleo/x-reader.git (GitHub). Even though GitHub is a known host, the install and runtime both pull third-party code dynamically (uvx fetch/execute), and that code will be executed locally. Dynamic fetching/execution of upstream code increases risk because upstream changes can alter behavior; a best practice is to pin to a specific commit or vendor the dependency.
Credentials
The skill does not request any environment variables, secrets, or unrelated credentials. Its network actions are limited to fetching the target URL via x-reader, which aligns with its stated purpose.
Persistence & Privilege
The skill is not always-enabled and does not request elevated privileges. However, because the platform allows autonomous invocation by default and the skill dynamically executes third-party code on each run, the blast radius is larger than for a purely local-only tool. Consider this if you allow the agent to invoke skills autonomously.
What to consider before installing
This skill is functionally coherent — it needs bun and uvx and uses x-reader to extract content — but it downloads and runs x-reader from GitHub at runtime. That means the code you execute is determined by an external repo (and can change). Before installing, consider: 1) Inspect the x-reader repository (or the specific commit/tag you will use) to ensure it is trustworthy. 2) Prefer a pinned commit/tag rather than a floating git ref, or vendor the x-reader code into the skill so behavior can't change silently. 3) Run the skill in a sandboxed environment or on a non-sensitive machine if you will allow autonomous invocation. 4) Note the small mismatch in SKILL.md (it suggests main.ts while the bundle contains main.js) — verify the script path when invoking. If you are not comfortable reviewing the upstream code, avoid installing or require manual approval before the skill runs.Like a lobster shell, security has layers — review code before you run it.
latestvk971mpjsv2mhjv25yx4x5eew0n84ag86
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📎 Clawdis
Binsbun, uvx
Install
uv
Bins: x-reader
uv tool install x-reader[all] @ git+https://github.com/runesleo/x-reader.git