Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Magic for AI Agents
v1.0.0Hand off tasks to human assistants and track their completion
⭐ 0· 1.1k·2 current·2 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The skill's stated purpose (routing tasks to human assistants via Magic API) is consistent with the SKILL.md content. However, the skill requires an API key (obtained at registration) to operate, but the registry metadata lists no required environment variables or primary credential — a mismatch between declared requirements and actual usage.
Instruction Scope
The SKILL.md explicitly instructs agents to include an 'Owner Contact Information' block (name, email, phone) in every task. That means the agent will be expected to transmit personally identifiable information and contact details to third-party humans. The instructions also require the agent to register and store an API key and to use it in requests. There are no instructions about minimizing shared data, redaction, or consent — this broadens scope from simple task delegation to the transmission of potentially sensitive PII to external human workers.
Install Mechanism
This is an instruction-only skill with no install spec and no code files, so nothing is written to disk by a package install. That is the lowest-risk install mechanism.
Credentials
Although SKILL.md requires obtaining and using an API key for all requests, the skill metadata declares no required environment variables or primary credential. The absence of a declared primary credential is an incoherence. Also, the instructions encourage transmitting owner PII to external staff — a privacy-sensitive capability that should be justified and scoped but isn't.
Persistence & Privilege
The skill does not request always:true and uses normal autonomous invocation defaults. Be aware that if the agent is allowed to invoke skills autonomously, it could automatically create tasks and send owner contact information to external humans without per-task user confirmation. The SKILL.md also requires you to 'SAVE YOUR API KEY' — the skill assumes persistent storage of credentials (not declared in metadata).
What to consider before installing
This skill genuinely implements a human-assistant task API, but it both requires an API key (not declared in the registry metadata) and asks you to include owner contact information (name, email, phone) in every task. Before installing: 1) Decide whether you are comfortable sending PII to third-party human workers and check the vendor's privacy/security policies. 2) Use a dedicated, scoped API key/account (not your main account), store the key securely (agent vault or environment variable) and rotate it if possible. 3) Avoid sending sensitive data (credentials, SSNs, medical info) in task instructions — redact or anonymize when feasible. 4) If the agent can act autonomously, require explicit user confirmation before creating tasks that include PII. 5) Be cautious of the metadata mismatch (no declared credential) — verify with the vendor or registry owner that the skill's required credentials and storage expectations are documented and safe.Like a lobster shell, security has layers — review code before you run it.
apivk97f9x26wpdt6ct7g13f1zw5yx810h7kautomationvk97f9x26wpdt6ct7g13f1zw5yx810h7khuman-in-the-loopvk97f9x26wpdt6ct7g13f1zw5yx810h7klatestvk97f9x26wpdt6ct7g13f1zw5yx810h7ktask-delegationvk97f9x26wpdt6ct7g13f1zw5yx810h7kvirtual-assistantvk97f9x26wpdt6ct7g13f1zw5yx810h7k
License
MIT-0
Free to use, modify, and redistribute. No attribution required.