Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Vet Repo
v1.1.1Scan repository agent configuration files for known malicious patterns
⭐ 0· 1.1k·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the included artifacts: the package ships a Python scanner (scripts/vet_repo.py) and a large pattern DB (scripts/patterns.py) that are directly used to scan agent-related config files. Nothing requested by the skill (no env vars, no external binaries) appears disproportionate to the stated purpose.
Instruction Scope
SKILL.md instructs the user/agent to run the local Python script against a given PROJECT_ROOT. The scanner reads a defined set of config files (.claude/, .mcp.json, CLAUDE.md, .vscode, .cursor) and supporting skill scripts (.py, .sh) and reports matches. This is consistent with the stated goal, but note it will read arbitrary files under the scan scope and will print matched contents (including any secrets it finds). The instructions do not execute repository code; they only open and inspect files.
Install Mechanism
No install spec or remote downloads are used. The skill is delivered with its Python scripts and runs locally; no external package fetching or archive extraction occurs.
Credentials
The skill requests no environment variables or credentials. The patterns include detections for secrets and sensitive configs (expected for a scanner), but the skill itself does not request access to those secrets or attempt to store them.
Persistence & Privilege
always is false and disable-model-invocation is true (the skill will not be autonomously invoked by the model). The skill does not modify other skills or global agent settings; it only reads repository files and prints a report.
Assessment
This looks like a legitimate repo scanner, but take the usual precautions before running code from an unknown source: 1) review scripts/vet_repo.py and scripts/patterns.py yourself to confirm behavior, 2) run the scanner on a copy of the repository or inside an isolated/containerized environment, 3) run it offline if you want to avoid accidental network access from other tools, and 4) be aware the scanner will surface any detected secrets or sensitive lines in its output — consider restricting output storage or scanning only non-sensitive copies. If you want stronger guarantees, inspect the pattern DB for false positives/negatives and run the script under restricted privileges.scripts/patterns.py:357
Shell command execution detected (child_process).
scripts/patterns.py:350
Dynamic code execution detected.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.Like a lobster shell, security has layers — review code before you run it.
latestvk97d06ar8feca9hhdjq4e65w0s83papdsecurityvk97b29syq0emhnw9yc9pfdqz5d80p8zz
License
MIT-0
Free to use, modify, and redistribute. No attribution required.