Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Agent Touch Layer
v0.1.0Mobile browser and native app automation via ATL (iOS Simulator). Navigate, click, screenshot, and automate web and native app tasks on iPhone/iPad simulators.
⭐ 0· 1.7k·1 current·2 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description (ATL iOS simulator automation) align with required binaries (xcrun, xcodebuild, curl) and the actions described (boot simulator, build app, install, curl local HTTP endpoints). The skill asks for no unrelated credentials or system config paths.
Instruction Scope
SKILL.md instructs the agent/user to clone a remote repo, build an app, launch UI tests and start local HTTP servers that can open any app and return accessibility trees/screenshots. Those instructions let the code execute arbitrary build/test steps and capture potentially sensitive UI/data from the simulator. They also instruct launching and interacting with system apps (Settings, Contacts, Photos), which is consistent with function but broad in data access.
Install Mechanism
Install steps are shell-based and rely on 'git clone https://github.com/JordanCoin/Atl' (no pinned commit, checksum, or verified release). Downloading and building code from an unverified upstream repo is moderate-to-high risk because the remote code could change and xcodebuild/test can execute arbitrary code during build or tests.
Credentials
No secrets or unrelated environment variables are required. The setup script uses optional env vars (ATL_ROOT, DEVICE, ATL_PORT) which are reasonable. However, the skill's ability to capture accessibility trees and screenshots means it can access simulator-contained data — so avoid running it against simulators that contain sensitive information.
Persistence & Privilege
always:false (no forced inclusion). The skill writes to the user's home (~/Atl) and installs an app into the simulator — expected for this functionality but still modifies user disk and simulator state. Model invocation is enabled (normal), which means the agent could autonomously run these steps if allowed.
What to consider before installing
This skill appears to do what it claims (build and drive an iOS Simulator automation server), but it downloads and builds code from an unverified GitHub repository and runs xcodebuild/test steps that may execute arbitrary code. Before installing: (1) inspect the upstream GitHub repo and specific commit the skill will clone; prefer a pinned commit or signed release; (2) review the ATL source code (especially any UI tests and network handlers) for data exfiltration/backdoors; (3) run the setup in an isolated environment (throwaway macOS user or VM) and avoid using simulators populated with real personal data; (4) consider running the build manually rather than allowing autonomous agent invocation; (5) if you need higher assurance, request a homepage, maintainer identity, or a checksum/pinned tag from the skill author. If you cannot verify the upstream repo or are uncomfortable with building remote code, treat this skill as high-risk and do not install it.Like a lobster shell, security has layers — review code before you run it.
latestvk973nzcxah0axs0msse4prhkwn80mfsa
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📱 Clawdis
Binsxcrun, xcodebuild, curl