Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

kbo-results

v1.0.0

Fetch KBO game schedules and results for a specific date with the kbo-game npm package. Use when the user asks for today's KBO games, yesterday's scores, or...

0· 61·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for 5eun/kbo-results.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "kbo-results" (5eun/kbo-results) from ClawHub.
Skill page: https://clawhub.ai/5eun/kbo-results
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install kbo-results

ClawHub CLI

Package manager switcher

npx clawhub@latest install kbo-results
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill claims to fetch KBO game data using the kbo-game npm package and the SKILL.md shows exactly that flow (importing getGame and formatting results). This capability matches the name/description. However, the manifest metadata (requirements) does not declare Node.js or npm or that a global package will be required, which is an inconsistency.
Instruction Scope
Runtime instructions are narrowly focused on installing/using kbo-game and formatting results. They do not request unrelated files or secrets. A discrepancy: the snippet relies on an environment variable (GLOBAL_NPM_ROOT) set in the wrapper command but the skill metadata doesn't declare it; the doc also forbids automatic fallbacks to other sources and insists on global installs.
!
Install Mechanism
There is no install spec in the manifest, but the SKILL.md instructs the agent to run `npm install -g kbo-game` if the package is missing. Installing a global npm package at runtime writes to system-wide locations and can require elevated privileges (or change the system state). While npm is a known registry, an instruction-only skill that performs global installs is higher risk and should have an explicit install mechanism and manifest declaration.
Credentials
The skill does not request secrets or credentials (no TOKENS/KEYS), which is appropriate. Still, it uses GLOBAL_NPM_ROOT and expects Node.js 18+ and global npm install capability — none of which are declared in the skill's requirements. The expected write access to global npm directories is a privilege that should be declared and justified.
!
Persistence & Privilege
The skill state is not marked always:true (good), but instructing a global npm install means the skill will change system state persistently (new global package files). The SKILL.md also calls the skill '조회 전용' (read-only), which contradicts the install step. This persistent, system-wide modification is a notable privilege and should be explicit and gated by user consent.
What to consider before installing
This skill appears to do what it says (use kbo-game to fetch KBO scores) but it has a few practical and security concerns you should consider before installing or allowing it to run: 1) It requires Node.js and the ability to install global npm packages, but the skill metadata does not declare these prerequisites — expect the agent to run `npm install -g kbo-game` which modifies system-wide files and can require sudo. 2) Installing a global npm package at runtime is persistent and higher-privilege; prefer a non-global install or packaging the dependency with the skill. 3) Verify the trustworthiness and exact version of the kbo-game package (look it up on the npm registry, check maintainer and recent activity) before allowing automatic installs. 4) If you want to reduce risk, require explicit user consent for the install step, add proper install metadata (Node requirement, explicit install script), or modify the skill to use a safe HTTP API or a bundled dependency rather than installing globally. 5) Ask the skill author to correct the manifest to declare Node/npm requirements and to remove the contradiction between ‘read-only’ and the install instruction.

Like a lobster shell, security has layers — review code before you run it.

latestvk972prkd5smszm66x1k6p0kma5851kpw
61downloads
0stars
1versions
Updated 1w ago
v1.0.0
MIT-0

KBO Results

What this skill does

kbo-game 패키지로 특정 날짜 KBO 경기 정보를 가져와 경기 일정, 스코어, 상태를 요약한다.

When to use

  • "오늘 KBO 경기 결과 알려줘"
  • "어제 한화 경기 스코어 보여줘"
  • "2026-04-01 KBO 일정 정리해줘"

Prerequisites

  • Node.js 18+
  • npm install -g kbo-game

Inputs

  • 날짜: YYYY-MM-DD
  • 선택 사항: 특정 팀명

Workflow

0. Install the package globally when missing

npm root -g 아래에 kbo-game 이 없으면 다른 구현으로 우회하지 말고 전역 Node 패키지 설치를 먼저 시도한다.

npm install -g kbo-game

패키지가 없다는 이유로 다른 비공식 scoreboard 소스를 자동 채택하지 않는다.

1. Fetch the date

GLOBAL_NPM_ROOT="$(npm root -g)" node --input-type=module - <<'JS'
import path from "node:path";
import { pathToFileURL } from "node:url";

const entry = pathToFileURL(
  path.join(process.env.GLOBAL_NPM_ROOT, "kbo-game", "dist", "index.js"),
).href;
const { getGame } = await import(entry);

const date = "2026-03-25";
const games = await getGame(new Date(`${date}T00:00:00+09:00`));
console.log(JSON.stringify(games, null, 2));
JS

kbo-game@0.0.2 기준 실제 export는 getGame 하나이며, 문자열 날짜("2026-03-25")를 직접 넘기면 실패한다. 항상 Date 객체로 변환해서 호출한다. 전역 설치를 기본으로 쓰므로 inline snippet에서는 전역 npm root 아래 entry file을 직접 import 한다.

2. Normalize for humans

원본 데이터를 그대로 던지지 말고 아래 기준으로 정리한다.

  • 홈팀 vs 원정팀
  • 진행 상태 또는 경기 종료 여부
  • 스코어
  • 필요한 경우 특정 팀만 필터링

3. Keep the answer compact

사용자가 scoreboard를 원하면 경기별 한 줄 요약부터 준다.

Done when

  • 날짜 기준 전체 경기 요약이 있다
  • 팀 필터 요청이면 해당 팀 경기만 남아 있다
  • raw JSON이 필요하면 별도로 제공할 수 있다

Failure modes

  • KBO 사이트 변경으로 패키지 응답이 깨질 수 있다
  • 비시즌 날짜는 빈 결과가 올 수 있다

Notes

  • 이 스킬은 조회 전용이다
  • 사용자 기준 "오늘/어제" 같은 상대 날짜는 항상 절대 날짜로 변환해서 실행한다

Comments

Loading comments...