Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Senior Backend
v2.1.1Designs and implements backend systems including REST APIs, microservices, database architectures, authentication flows, and security hardening. Use when the...
⭐ 0· 2.8k·17 current·17 all-time
byAlireza Rezvani@alirezarezvani
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The skill name/description (API design, DB migrations, load testing) matches the included artifacts: an API scaffolder, database migration tool, load tester, and multiple backend/security references. The requested binaries/env in metadata are minimal (none), which is plausible for a pure Python script bundle, but see environment_proportionality for problems.
Instruction Scope
SKILL.md instructs the agent (or user) to run bundled scripts that accept database connection strings and API endpoints and can perform schema analysis, generate and run migrations, and run high-concurrency HTTP load tests. Those actions can modify production databases or generate high traffic against external services. The instructions and examples also reference environment variables and secrets (e.g., $DATABASE_URL, process.env.JWT_SECRET, STRIPE_WEBHOOK_SECRET) and do not include explicit safeguards or authorization checks. The skill gives the agent broad discretion to run operations that access internal resources and perform potentially destructive actions.
Install Mechanism
There is no install spec; this is instruction-only with bundled Python scripts. No remote downloads or package installers are specified, so nothing will be fetched at install time. Risk comes from executing the included scripts (they are present in the bundle) rather than from installation.
Credentials
The registry metadata declares no required environment variables, but SKILL.md examples and the bundled code reference many sensitive env vars and secrets (DATABASE_URL, DB_HOST/DB_USER/DB_PASSWORD, JWT_SECRET, JWT_REFRESH_SECRET, STRIPE_WEBHOOK_SECRET, LOG_LEVEL, etc.). That mismatch means the skill expects access to credentials and secrets that were not disclosed in the manifest. Requiring DB credentials or signing secrets is reasonable for a migration or auth helper, but the lack of explicit declared env requirements is a transparency problem and increases risk if the agent is given those secrets.
Persistence & Privilege
The skill is not marked always:true and does not request persistent system-level privileges. It appears not to modify other skills or system settings. The primary concern is runtime: the scripts, when executed, can perform DB migrations and network load tests but they do so only when invoked.
What to consider before installing
This skill contains real tooling that matches its description, but it also expects credentials and can perform actions that modify databases or generate heavy network traffic. Before installing or invoking it: 1) Review the bundled Python scripts yourself (they are included) and confirm you trust their behavior. 2) Don't run the migration tool against production databases without backups and a least-privilege DB user; run on staging first. 3) Only target load tests at systems you own or have explicit permission to test; otherwise you could cause outages or legal issues. 4) Because the manifest does not list required secrets but the code uses them (DB credentials, JWT secrets, webhook secrets), explicitly identify which environment variables you'll supply and prefer temporary, least-privileged credentials. 5) Run the scripts in an isolated environment (container or isolated VM) and consider running static/lint/security scans (e.g., bandit, flake8) before giving any credentials. If you want, ask the publisher for an explicit list of required env vars and a safety checklist for running migrations and load tests.Like a lobster shell, security has layers — review code before you run it.
backendvk97aeqk3nhk9sq7gn3var52d9n8065e2engineeringvk97aeqk3nhk9sq7gn3var52d9n8065e2latestvk979rmzaxgsgzey9hahzr6vdh982j9ry
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
