Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Cross Bot Communication
v1.0.3Enables bots in the same group or channel to automatically detect each other, verify identities, and communicate seamlessly without configuration.
⭐ 0· 364·3 current·3 all-time
byAnonymous@adminlove520
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill promises automatic scanning of existing groups/channels and building a 'social relationship' table between owners and bots. That functionality reasonably requires access to chat platform data and bot tokens (e.g., Telegram bot_token shown in config.example.json), but the skill declares no required credentials, binaries, or config paths — this mismatch suggests the declared requirements are incomplete or misleading.
Instruction Scope
SKILL.md explicitly instructs the agent to 'scan existing groups/channels' and build/maintain a relations table and perform automated binding. Those instructions imply reading chat membership, bot roles, and possibly user identifiers. The instructions do not disclose where scanned data is stored, what connectors/APIs are used, or whether any data is transmitted externally (the fallback_method value 'github_discussion' in config.example.json is notable). This scope (scanning all groups/channels) is broad and privacy-sensitive.
Install Mechanism
There is no install spec and no code files to execute, which reduces immediate disk-write/remote-download risk. However, because the skill is instruction-only, the actual behavior depends entirely on the agent's existing connectors and permissions — the absence of install artifacts lowers one class of risk but doesn't eliminate runtime access concerns.
Credentials
The skill declares no required environment variables, but config.example.json includes sensitive fields (bot_token, default_channel_id) and the README describes scanning and building relation tables. Requiring such secrets without declaring them is disproportionate and opaque. It's unclear which credentials the agent will need or how they should be provided/stored.
Persistence & Privilege
always is false (good), but the skill's runtime behavior (automatic scanning across groups/channels and maintaining relations) implies broad access to agent-connected chat data. There is no description of data retention, storage location, or access controls for the generated relation table, meaning persistent sensitive state could be created without clear governance.
What to consider before installing
This skill asks the agent to scan all groups/channels and build a relations table but declares no required credentials; don't install yet. Before proceeding, ask the author: (1) exactly which platform APIs/connectors will be used and what credentials are required (e.g., TELEGRAM_BOT_TOKEN) and why they aren't declared, (2) where scanned data and the relations table are stored and who can read them, (3) whether any data is sent to external endpoints (the config.example's 'fallback_method' including 'github_discussion' is suspicious), and (4) whether you can limit the skill's scope (test in an isolated account or restrict to a single group). If you can't verify the source or get clear answers, avoid installing or run it only with a throwaway bot/account with minimal permissions.Like a lobster shell, security has layers — review code before you run it.
latestvk978z4nk5snfq4pydzacqyf27d82rqyb
License
MIT-0
Free to use, modify, and redistribute. No attribution required.