Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Sort
v3.0.2Sort files, lines, and columns with custom ordering and dedup. Use when scanning duplicates, monitoring changes, reporting results, alerting anomalies.
⭐ 0· 186·1 current·1 all-time
byBytesAgain2@ckchzh
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the code and instructions: the script implements line/csv/json/dedup/shuffle/rank/top/freq/stats operations. No unrelated credentials, binaries, or network access are requested.
Instruction Scope
Runtime instructions are focused on file-processing commands and match the included script. The SKILL.md and script explicitly log operations to ~/.local/share/sort/history.log; this is in-scope for an audit trail but is additional data collection the user should expect.
Install Mechanism
No install spec or external downloads; the skill is instruction + an included shell script. It relies on standard OS utilities (sort, awk, head, tail, etc.) and optionally jq/python3 if available.
Credentials
No environment variables, credentials, or config paths are required. The script checks for optional tools (jq, python3) but does not request secrets or unrelated tokens.
Persistence & Privilege
The script creates ${HOME}/.local/share/sort and appends operations to history.log. This is limited persistence (per-user) and appears reasonable for audit logging, but it will store filenames and operation metadata locally.
Assessment
This skill appears coherent and local-only: it sorts and analyses files using a bundled shell script and standard utilities. Before installing or invoking it, be aware that it will create ~/.local/share/sort/history.log and append entries containing the filenames and operation details (counts, flags). If you plan to run it on sensitive files, either inspect the script yourself, run it in a sandbox, or clear/relocate the history file afterwards. Also note the python fallback embeds the provided JSON key into inline Python code (unescaped), which is fine for normal keys but could misbehave with unexpected characters—prefer using jq if available. Otherwise there are no requested credentials or network endpoints to be concerned about.Like a lobster shell, security has layers — review code before you run it.
latestvk97ddt86xg3vf7gp6e7jraycy9836sdn
License
MIT-0
Free to use, modify, and redistribute. No attribution required.