Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Coaching
v2.0.0Coaching practice support with session preparation, question generation, client progress tracking, and goal setting. Use when user mentions coaching sessions...
⭐ 0· 380·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The description promises session prep, question generation, progress tracking, goal setting, and between-session messaging. Only one script (scripts/prep_session.py) is included. SKILL.md lists many other scripts and reference docs that are not present, so the package does not deliver the advertised capabilities.
Instruction Scope
Runtime instructions direct the agent to run many scripts (generate_questions.py, track_progress.py, set_goal.py, between_sessions.py, etc.) and reference multiple docs, but those files are missing. The SKILL.md claims 'Send between-session support' which could imply outbound messaging, but no code for outbound communication exists in the provided files. The included script operates only on local files and prints output — it does not exfiltrate data.
Install Mechanism
No install spec (instruction-only plus one script). Nothing is downloaded or written by an installer; lowest risk from installation mechanism.
Credentials
No environment variables, credentials, or external endpoints are requested. The included script reads per-client JSON files under ~/.openclaw/workspace/memory/coaching, which aligns with the declared local-only storage policy.
Persistence & Privilege
Skill is not always-enabled and does not request elevated privileges. It does not modify other skills or global agent settings. The script reads local files only and does not autonomously invoke network access in its current form.
What to consider before installing
Do not install or use this skill for confidential client data until the missing pieces are resolved. Specifically:
- Ask the publisher for the missing scripts and reference docs listed in SKILL.md and confirm their behavior (generate_questions.py, track_progress.py, between_sessions.py, etc.).
- Verify whether any of the missing scripts send messages or access network endpoints (the phrase 'Send between-session support' could imply external communication). If they do, confirm what credentials/endpoints they use and whether you approve.
- Confirm where the skill will store data on your system (the code uses ~/.openclaw/workspace/memory/coaching). Ensure that path and file permissions meet your confidentiality requirements.
- If you proceed, run the skill in a sandbox or inspect the full code for all scripts to ensure there is no hidden network activity or unexpected file access. Consider backing up any existing data before first use.
If the publisher provides the full source and it matches the local-only claims, the skill would be reasonable to use for coaching tasks; until then, the discrepancy is a red flag.Like a lobster shell, security has layers — review code before you run it.
coachvk978xp05nr3yyv27bwkppr9b4582nghzcoachingvk978xp05nr3yyv27bwkppr9b4582nghzgoalsvk978xp05nr3yyv27bwkppr9b4582nghzgrowthvk9739s6bb5c0yas8d62309ax3x82e4vdlatestvk978xp05nr3yyv27bwkppr9b4582nghzmindsetvk9739s6bb5c0yas8d62309ax3x82e4vdproductivityvk9739s6bb5c0yas8d62309ax3x82e4vdprogressvk978xp05nr3yyv27bwkppr9b4582nghzsessionsvk978xp05nr3yyv27bwkppr9b4582nghz
License
MIT-0
Free to use, modify, and redistribute. No attribution required.