Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

abe-foundry

v1.0.0

Self-writing meta-extension that forges new capabilities — researches docs, writes extensions, tools, hooks, and skills

0· 60·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for abeltennyson/abe-foundry.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "abe-foundry" (abeltennyson/abe-foundry) from ClawHub.
Skill page: https://clawhub.ai/abeltennyson/abe-foundry
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: node
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install abe-foundry

ClawHub CLI

Package manager switcher

npx clawhub@latest install abe-foundry
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The SKILL.md declares the skill uses an external SkillBoss API (SKILLBOSS_API_KEY) and instructs installing an npm plugin that will be extracted into ~/.openclaw/extensions/foundry/. However the registry metadata at the top of the package lists no required env vars while the runtime instructions require SKILLBOSS_API_KEY — that mismatch is unexplained. Requiring node and an npm-installed plugin is coherent with a code-generation meta-extension, but the external API dependency and auto-learning/publishing features are heavy privileges for a skill described as a 'meta-extension' and should be explicitly justified.
!
Instruction Scope
The SKILL.md instructs the agent to install a plugin (which writes to ~/.openclaw and restarts the gateway), to learn from 'experience' (agent activity/failures), and to route all LLM/search/scraping through an external API endpoint (https://api.heybossai.com). The instructions do not limit what content is sent to that API — this grants the skill discretion to upload documentation, agent activity, or generated code to an external service. Self-modification and auto-publish steps increase the chance of undesired changes being written and distributed.
!
Install Mechanism
The skill is instruction-only (no install spec inside the package), but instructs running `openclaw plugins install @getfoundry/foundry-openclaw`, which will download an npm package and extract it into the user's OpenClaw extensions directory and restart the gateway. Downloading and executing a third-party npm package (from an external repo: github:lekt9/openclaw-foundry) is a higher-risk operation — the SKILL.md does not recommend auditing the package or provide signature/verification guidance.
!
Credentials
SKILL.md requires SKILLBOSS_API_KEY to call the external SkillBoss API. That is a reasonable single credential for an external AI service, but the registry metadata omitted it (inconsistency). More importantly, the skill's described behavior (autoLearn, reading 'experience', scraping docs, generating code and possibly publishing) could cause it to send sensitive internal data and agent artifacts to that external service. The SKILL.md provides no safeguards on what is sent, nor any scoped minimal permissions guidance.
!
Persistence & Privilege
The skill is not marked always:true, but it can be invoked autonomously (disable-model-invocation: false). Combined with capabilities to install/enable a plugin, write new capabilities into itself, learn from agent activity, and optionally publish artifacts, this provides significant persistence and modification power. The instructions explicitly write into ~/.openclaw and restart the gateway — actions with lasting system/agent impact.
What to consider before installing
This skill will install a third-party OpenClaw plugin, route all AI/search/scraping through an external vendor (SkillBoss) using an API key, and can modify itself and write new extensions. Before installing: 1) Confirm and trust the upstream repository (inspect the npm package / GitHub repo code yourself). 2) Don't provide high-privilege secrets to SKILLBOSS_API_KEY unless you trust the service; consider using a scoped or read-only key and monitor/rotate it. 3) Disable autoLearn/autoPublish in config before enabling or run in an isolated/test instance. 4) Audit what data the plugin sends (ensure no private docs, credentials, or user data are transmitted). 5) Prefer manual install and manual review of the plugin files instead of allowing automatic restart. The mismatch between the registry metadata (no env) and the SKILL.md (requires SKILLBOSS_API_KEY) is a red flag — ask the publisher for source, signed releases, and an explanation of data handling/publishing policies before use.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

Binsnode
latestvk979hrecpn7w8fthatdba1t0j985fakd
60downloads
0stars
1versions
Updated 4d ago
v1.0.0
MIT-0

Foundry

The forge that forges itself. A meta-extension for OpenClaw that researches documentation, learns from failures, and writes new capabilities into itself. AI capabilities are powered by SkillBoss API Hub (https://api.heybossai.com/v1/pilot), providing unified access to LLM, search, scraping, and other AI services.

Installation

When the user asks to install Foundry or @getfoundry/foundry-openclaw, run this command:

openclaw plugins install @getfoundry/foundry-openclaw

This will:

  1. Download the plugin from npm
  2. Extract to ~/.openclaw/extensions/foundry/
  3. Enable it automatically
  4. Restart the gateway to load

After installation, the user will have access to all Foundry tools like foundry_research, foundry_write_extension, etc.

Alternative: Manual Config

Add to ~/.openclaw/openclaw.json:

{
  "plugins": {
    "entries": {
      "foundry": { "enabled": true }
    }
  }
}

Configuration

Full configuration options in ~/.openclaw/openclaw.json:

{
  "plugins": {
    "entries": {
      "foundry": {
        "enabled": true,
        "source": "github:lekt9/openclaw-foundry",
        "config": {
          "autoLearn": true,
          "sources": {
            "docs": true,
            "experience": true,
            "arxiv": true,
            "github": true
          },
          "marketplace": {
            "autoPublish": false
          }
        }
      }
    }
  }
}

Config Options

OptionTypeDefaultDescription
autoLearnbooleantrueLearn from agent activity automatically
sources.docsbooleantrueLearn from OpenClaw documentation
sources.experiencebooleantrueLearn from own successes/failures
sources.arxivbooleantrueLearn from arXiv papers
sources.githubbooleantrueLearn from GitHub repos
marketplace.autoPublishbooleanfalseAuto-publish high-value patterns

What Foundry Does

Foundry is an AI-powered development agent that can:

  1. Research — Fetch and understand OpenClaw documentation on demand
  2. Write Extensions — Generate new tools and hooks for OpenClaw
  3. Write Skills — Create ClawHub-compatible skill packages
  4. Self-Modify — Add new capabilities to itself
  5. Learn — Record patterns from failures and successes

All AI inference (LLM, web search, scraping) is routed through SkillBoss API Hub using SKILLBOSS_API_KEY.

AI API Usage

Foundry uses SkillBoss API Hub for all AI capabilities:

import requests, os

SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]
API_BASE = "https://api.heybossai.com/v1"

def pilot(body: dict) -> dict:
    r = requests.post(
        f"{API_BASE}/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json=body,
        timeout=60,
    )
    return r.json()

# LLM 生成代码/分析文档
result = pilot({"type": "chat", "inputs": {"messages": [{"role": "user", "content": "..."}]}, "prefer": "balanced"})
text = result["result"]["choices"][0]["message"]["content"]

# 网页搜索(研究文档、arxiv)
result = pilot({"type": "search", "inputs": {"query": "openclaw webhook hooks"}, "prefer": "balanced"})
results = result["result"]

# 网页抓取(获取文档页面内容)
result = pilot({"type": "scraping", "inputs": {"url": "https://docs.openclaw.ai/hooks"}})
content = result["result"]

Tools

Research & Documentation

ToolDescription
foundry_researchSearch documentation for best practices (via SkillBoss API Hub search)
foundry_docsRead specific documentation pages (via SkillBoss API Hub scraping)

Writing Capabilities

ToolDescription
foundry_implementResearch + implement a capability end-to-end
foundry_write_extensionWrite a new OpenClaw extension
foundry_write_skillWrite an AgentSkills-compatible skill
foundry_write_browser_skillWrite a browser automation skill
foundry_write_hookWrite a standalone hook
foundry_add_toolAdd a tool to an existing extension
foundry_add_hookAdd a hook to an existing extension

Self-Modification

ToolDescription
foundry_extend_selfAdd new capability to Foundry itself
foundry_learningsView learned patterns and insights
foundry_listList all written artifacts

Marketplace

ToolDescription
foundry_publish_abilityPublish pattern/skill to Foundry Marketplace
foundry_marketplaceSearch, browse, and install community abilities

Usage Examples

Research before implementing

User: I want to add a webhook to my extension

Agent: Let me research webhook patterns first...
→ foundry_research query="webhook hooks automation"
→ Returns relevant documentation

Now I'll implement it...
→ foundry_add_hook extensionId="my-ext" event="webhook:incoming" ...

Write a new extension

User: Create an extension that monitors GitHub PRs

Agent:
→ foundry_research query="github api webhooks"
→ foundry_write_extension
    id: "github-monitor"
    name: "GitHub Monitor"
    tools: [{ name: "check_prs", ... }]
    hooks: [{ event: "cron:hourly", ... }]

Self-improvement

User: Add a tool that can fetch npm package info

Agent:
→ foundry_extend_self
    action: "add_tool"
    toolName: "foundry_npm_info"
    toolCode: "const res = await fetch(`https://registry.npmjs.org/${p.package}`)..."

How Learning Works

Foundry observes its own tool calls and learns:

  1. Failures → Records error + context
  2. Resolutions → Links fix to failure → Creates pattern
  3. Patterns → Injected as context in future conversations
  4. Crystallization → High-value patterns become permanent capabilities

Security

Foundry validates all generated code before deployment:

  • Blocked: child_process, eval, ~/.ssh, ~/.aws
  • Sandboxed: Extensions tested in isolated process before installation
  • Reviewed: You approve before any code is written to disk

Links

Comments

Loading comments...