Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Ffi Code Review
v1.0.0Reviews Rust FFI code for type safety, memory layout compatibility, string handling, callback patterns, and unsafe boundary correctness. Use when reviewing e...
⭐ 0· 51·0 current·0 all-time
byKevin Anderson@anderskev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description match the files and instructions: this is an instruction-only Rust FFI code-review checklist and reference material. It does not request unrelated credentials, binaries, or install steps, which is appropriate for its stated purpose.
Instruction Scope
Most instructions stay on-topic (inspect Cargo.toml, build.rs, extern blocks, types, strings, ownership, callbacks). However the workflow contains an unexplained step: "Load `beagle-rust:review-verification-protocol` before submitting findings" — there is no specification for what this means, how to load it, or what external endpoint/skill/protocol is involved. Additionally several checklist items reference hypothetical "Edition 2024" syntax (e.g., `#[unsafe(no_mangle)]`, `#[unsafe(export_name = "...")]`) that are not standard Rust attributes and could mislead reviewers. The instructions also assume developer tools (cargo +nightly, sanitizers, valgrind) are available but provide no install guidance — this is normal for an instruction-only skill but worth noting.
Install Mechanism
No install spec (instruction-only). This is lowest-risk from an install perspective: nothing will be downloaded or written to disk by the skill itself.
Credentials
The skill requests no environment variables or credentials. It references common build env vars (OUT_DIR, RUSTFLAGS) and running toolchains, which are expected for FFI review and do not indicate excessive privilege or secret access.
Persistence & Privilege
Skill is not always-enabled and requests no persistent presence or modification of other skills or system-wide settings. Autonomous invocation is allowed by platform default but not combined with other red flags here.
What to consider before installing
This is an instruction-only FFI-review checklist and appears mostly coherent and useful. Before installing or relying on it: 1) Confirm what "Load beagle-rust:review-verification-protocol" means — ask the author to explain how verification should be performed and whether it calls any external service or other skill. 2) Be aware some checklist items reference nonstandard Rust attributes/syntax (the "Edition 2024" examples); verify them against current Rust language docs to avoid following incorrect guidance. 3) The skill assumes developer tools (cargo, nightly toolchain, sanitizers, valgrind) are available; do not run commands from the checklist on systems where you cannot safely build or test untrusted code. If the author can clarify the verification step and remove or justify the nonstandard Rust attributes, the skill would be coherent and low-risk.Like a lobster shell, security has layers — review code before you run it.
latestvk9703ax881nn6d6rem0nqrbzx184qymh
License
MIT-0
Free to use, modify, and redistribute. No attribution required.