Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Reagent Expiry Alert
v1.0.0Scan reagent barcodes or IDs, log expiration dates, and generate multi-level alerts before reagent expiry to support laboratory inventory management.
⭐ 0· 37·0 current·0 all-time
byAIpoch@aipoch-ai
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The declared purpose (scan barcodes, log expiries, generate multi-level alerts, provide reorder recommendations) mostly matches the included script's high-level intent (local expiry tracking and alert printing). However, the SKILL.md promises multi-level alerts (30/60/90 days), explicit 'warning' and 'critical' levels, and reorder recommendations; scripts/main.py implements only a basic local JSON inventory and a check_alerts that produces two categories (expired and soon) based on a single alert-days threshold. Reorder recommendations are not computed. The mismatch between claimed features and actual implementation is a substantive incoherence.
Instruction Scope
SKILL.md instructs running the packaged script and describes acceptable inputs; it does not explicitly state that the script will create and write to ~/.openclaw/reagent_inventory.json. The script does create that path and reads/writes JSON locally. There is no networking or access to unrelated files or env vars. The SKILL.md asks for date validation on input, but the script does not validate expiry at scan time (it simply stores the string), which can lead to errors later when check_alerts parses expiry dates.
Install Mechanism
No install spec or external downloads — instruction-only plus a bundled script. Nothing is fetched from remote URLs and no packages are installed. This is the lowest-risk install mechanism.
Credentials
The skill requires no environment variables, no credentials, and no external config paths. The script writes a local JSON file in the user's home directory (~/.openclaw/reagent_inventory.json) which is proportional to the declared purpose.
Persistence & Privilege
The skill is not marked always:true and does not modify other skills or system-wide settings. Its only persistent effect is creating and writing a single JSON file in the user's home directory, which is expected for a local inventory tool.
What to consider before installing
This skill is not obviously malicious, but there are clear mismatches and a small bug risk you should consider before using it on real inventory:
- Implementation vs documentation: The SKILL.md promises multi-level alerts (e.g., 30/60/90 days), distinct warning/critical levels, and reorder recommendations; the included script only implements a simple local JSON inventory and a single alert threshold (alert-days). Reorder recommendations are not produced. Expect fewer features than the docs claim.
- Bug / validation risk: The script does not validate expiry dates when scanning — it stores the string as provided. Later, check_alerts uses datetime.fromisoformat and could error if an unexpected format is stored. Also, the code treats items with <=7 days as 'expired' (adds them to the expired list), which is likely a logic bug compared with the intended behavior described in the docs.
- Data storage and privacy: Inventory is saved unencrypted at ~/.openclaw/reagent_inventory.json. That file could contain sensitive lab inventory data. Review, secure, and back up that file; consider file permissions or encryption if needed.
- Testing recommendation: Run python -m py_compile scripts/main.py and exercise the script in a safe environment (use throwaway inventory and a test home directory) to confirm behavior. Inspect and/or patch the script to implement proper date validation on scan, correct the alert thresholds, and add any missing features (warning levels, reorder logic) before trusting it with production data.
- If you need the promised features or stronger guarantees, request a revised version from the author (author info is missing) or modify the script yourself. Avoid using this tool for controlled substances or regulated items (SKILL.md already advises against that).Like a lobster shell, security has layers — review code before you run it.
latestvk978za5y84jvcprrvm89dxh99983zsvt
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
