ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Accept Task

v0.1.2

Accept or apply for a task on OpenAnt. Use when the agent wants to take on work, accept a bounty, apply for a job, pick up a task, or volunteer for an assign...

⭐ 0· 313·0 current·0 all-time
by@ant-1984
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
Name, description, and allowed tools all point to using the OpenAnt CLI to accept or apply for tasks. No unrelated environment variables, binaries, or config paths are requested.
ℹ
Instruction Scope
Instructions are narrowly scoped to calling the OpenAnt CLI (status, tasks get, accept, apply). However the SKILL.md explicitly says to execute immediately when the user asks the agent to find and take work and 'No confirmation needed' — this can cause irreversible account-side actions (accepting assignments) if the agent runs autonomously. The skill does not instruct reading unrelated files or env vars.
ℹ
Install Mechanism
Instruction-only (no install spec) but relies on npx @openant-ai/cli@latest at runtime. That will fetch and execute code from the npm registry (supply-chain risk compared with a pinned or audited binary). This is expected for a CLI-driven skill but worth noting.
✓
Credentials
The skill declares no required environment variables or credentials. It references an external 'authenticate-openant' skill for auth; the current skill does not request unrelated secrets.
✓
Persistence & Privilege
always:false and no install or config writes are present. The skill does not request permanent presence or access to other skills' configs. The main concern is the guidance to act immediately without confirmation.
Assessment
This skill appears coherent for accepting/applying to tasks on OpenAnt, but consider the following before installing: (1) The skill runs npx @openant-ai/cli@latest which downloads and executes code from the npm registry — if you care about supply-chain safety, prefer a pinned version or inspect the CLI source first. (2) The SKILL.md encourages immediate acceptance with 'No confirmation needed' — make sure you (or the agent policy) only call this after explicit user approval, since accepting a task can commit your account. (3) The skill delegates authentication to an 'authenticate-openant' skill; review how that handles credentials. If you expect safer behavior, request confirmation steps or version-pinning for the CLI.

Like a lobster shell, security has layers — review code before you run it.

latestvk97e3n3td86z9ks8gd4j7j0hq5822ts3

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments