Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Structs Energy
v1.2.0Manages energy capacity in Structs. Covers increasing capacity (reactor infusion, generator infusion, buying agreements), selling surplus energy (creating pr...
⭐ 0· 396·0 current·1 all-time
by@abstrct
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description (managing energy in Structs) align with the runtime instructions. All commands are structsd CLI queries and transactions relevant to increasing/selling energy and managing agreements, so required capabilities are coherent with the stated purpose.
Instruction Scope
The SKILL.md tells the agent to execute structsd tx commands that sign and broadcast blockchain transactions (e.g., reactor-infuse, generator-infuse, agreement-open). Example commands include --from [key-name] and the -y flag (auto-confirm), enabling immediate irreversible actions. The instructions do not require additional safety confirmations or explicit user approvals and assume access to the user's CLI keyring; this broadens the scope beyond read-only queries to potentially destructive, spend-capable operations.
Install Mechanism
Instruction-only skill with no install spec and no code files — lowest installation risk. Nothing is downloaded or written to disk by the skill package itself.
Credentials
The skill declares no environment variables or credentials, which is consistent with being instruction-only. However, its commands require specifying --from [key-name] and will use the structsd CLI keyring to sign transactions; that implies the agent must have access to local signing keys or run commands under a user account with keys available. The SKILL.md does not articulate how signing keys should be provided or protected.
Persistence & Privilege
always is false (no permanent inclusion), but the platform default allows autonomous invocation. Combined with instructions that perform auto-confirmed transactions (-y) and signing via the CLI keyring, autonomous invocation could lead to the agent executing irreversible on-chain operations without explicit human confirmation. This is a behavioral risk even though the skill does not request system-level privileges directly.
Scan Findings in Context
[no_regex_findings] expected: The package is instruction-only (SKILL.md only). The regex scanner had no code files to analyze; lack of findings is expected but does not imply safety because the runtime instructions themselves perform networked, state-changing actions.
What to consider before installing
This skill is coherent with its stated purpose, but it instructs the agent to run structsd commands that sign and broadcast transactions (some irreversible) and uses example commands with -y (auto-confirm). Before installing or enabling it: 1) Only permit it if you trust the agent and environment; do not allow autonomous execution if your CLI keyring is accessible. 2) Require manual confirmation for any tx — remove '-y' in commands or require an explicit user prompt. 3) Keep signing keys in a separate, protected environment (or use a read-only account) when testing. 4) Test in a non-production/guild/testnet environment first. 5) Review any addresses/amounts the agent will use before executing transactions. If you are not comfortable giving the agent the ability to run structsd tx commands that use your keys, do not enable this skill.Like a lobster shell, security has layers — review code before you run it.
latestvk975mp0hdz2401b0hzqn707nkn83xx6s
License
MIT-0
Free to use, modify, and redistribute. No attribution required.