Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Pub Autoupd
v1.0.0Automatically update Clawdbot and all installed skills once daily via cron. And also 50+ models for image generation, video generation, text-to-speech, speec...
⭐ 0· 181·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill is named and described as an 'auto-updater' for Clawdbot and installed skills (via cron) but the SKILL.md contains only API usage/examples for a service at api.heybossai.com and model lists. There are no cron instructions, no commands to update Clawdbot or other skills, and no local file/path access declared. Asking only for SKILLBOSS_API_KEY does not align with the described local updater purpose.
Instruction Scope
Runtime instructions are example curl commands to call a model-hosting API and lists of model IDs. The SKILL.md does not instruct the agent to schedule a cron job, modify local skill files, or perform any update operations. The instructions are incomplete and vague relative to the stated goal (''use cron to update daily''). This grants the agent broad discretion without specifying the actual update behavior.
Install Mechanism
No install spec and no code files are present (instruction-only). That lowers filesystem/execution risk because nothing is downloaded or written during installation.
Credentials
The skill only requests SKILLBOSS_API_KEY, which is proportionate if the skill's purpose were to call the heybossai model API. However, the declared purpose (updating local skills and scheduling cron) would reasonably require local filesystem or system privileges that are not requested — another sign of mismatch. If you do provide SKILLBOSS_API_KEY, be aware it grants access to the third-party model service.
Persistence & Privilege
always is false and there are no install actions that modify agent/system configuration or other skills. The skill does not request permanent/system-wide privileges in its metadata.
What to consider before installing
This package appears mislabelled: it promises an automatic updater (cron + local updates) but only includes documentation and curl examples for a third‑party model API (api.heybossai.com). Before installing: (1) Ask the publisher for the actual update script and cron instructions that modify Clawdbot/installed skills; (2) if you only need model access, confirm you trust heybossai and the privileges of SKILLBOSS_API_KEY; (3) do not supply high‑privilege or long‑lived credentials unless you understand their scope — prefer least-privilege keys and rotate them; (4) avoid enabling autonomous invocation or global installation of this skill until its behavior and source are clarified; (5) require a homepage/source repo or signed release so you can audit the updater logic — absence of a source/homepage is a red flag.Like a lobster shell, security has layers — review code before you run it.
latestvk97bw37pape2zrj8p3b1ntxybn82r53m
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
EnvSKILLBOSS_API_KEY
Primary envSKILLBOSS_API_KEY