Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

SeedFlip Dashboard Theme

v1.0.0

Re-theme your OpenClaw dashboard with 104 curated design seeds from SeedFlip. Fonts, colors, shadows, radii. One command, instant transformation.

0· 300·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for bockenstette1/seedflip-theme.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "SeedFlip Dashboard Theme" (bockenstette1/seedflip-theme) from ClawHub.
Skill page: https://clawhub.ai/bockenstette1/seedflip-theme
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install seedflip-theme

ClawHub CLI

Package manager switcher

npx clawhub@latest install seedflip-theme
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description match the implementation: the package exposes get_design_seed and list_design_seeds, produces OpenClaw-ready CSS/themes, and the SKILL.md advises adding an MCP server entry running `npx -y seedflip-mcp`. The code and bundled seed data are proportional to a theming tool.
!
Instruction Scope
SKILL.md instructs the agent to run an MCP server via npx and to fetch/apply seeds; that is consistent. However the runtime code (dist/index.js) performs an undocumented network POST (telemetry) that will send user queries and returned seed names to https://seedflip.co/api/track. The instructions and README do not disclose this telemetry behavior, so the runtime scope is broader than the documentation implies.
Install Mechanism
There is no automatic install spec in the registry, but SKILL.md/README tell users to run `npx -y seedflip-mcp` (or npm install -g). Using npx pulls and executes code from npm — expected for an MCP helper but carries the usual risk of executing remote code. The included source in the bundle appears to match the npx runtime, so no arbitrary nonstandard download-URL redirects were found.
!
Credentials
The skill requests no environment variables or credentials, which is appropriate. However the implementation sends POST telemetry containing the user's query and the list of seed names to seedflip.co. Because user queries may contain sensitive or proprietary context, this telemetry is a disproportionate data exposure relative to the simple UI-theming purpose and is not called out in the docs.
Persistence & Privilege
The skill does not request always:true, does not declare system config paths, and doesn't attempt to modify other skills or global agent config. It runs as an MCP server process (invoked by npx) and that behavior is expected for this use case.
What to consider before installing
This skill appears to be a legitimate theming tool, but it includes undocumented telemetry: the MCP server code sends your query string and selected seed names to https://seedflip.co/api/track. Before installing or running it, consider: (1) audit the package source on npm (or the bundled source here) to confirm what is sent; (2) avoid sending sensitive/project-specific text in queries (telemetry will include the raw query); (3) if you prefer no telemetry, self-host or run a local copy of the code after removing the trackMcpQuery call; (4) run npx commands in an isolated/dev environment first to observe behavior; (5) ask the author or vendor for an explicit privacy/telemetry disclosure and an opt-out. If these telemetry concerns are acceptable or mitigated (self-hosting, reviewing/removing telemetry), the skill is otherwise coherent for its stated purpose.

Like a lobster shell, security has layers — review code before you run it.

latestvk97efndz4cyd6dgjz9fxfwgnkx82mbfd
300downloads
0stars
1versions
Updated 8h ago
v1.0.0
MIT-0

SeedFlip Dashboard Theme

You are a dashboard theming agent. You apply curated design seeds from SeedFlip to transform the visual appearance of the user's OpenClaw dashboard.

What You Do

When the user asks to theme, restyle, or redesign their dashboard, you:

  1. Ask what vibe they want (or pick a random seed if they say "surprise me")
  2. Fetch a design seed from the SeedFlip MCP server
  3. Apply the CSS variables to their dashboard

Setup

This skill requires the SeedFlip MCP server. Add it to your MCP configuration:

{
  "mcpServers": {
    "seedflip": {
      "command": "npx",
      "args": ["-y", "seedflip-mcp"]
    }
  }
}

How to Fetch Seeds

Use the get_design_seed MCP tool:

Get a specific vibe

get_design_seed(query: "dark minimal", format: "openclaw")
get_design_seed(query: "Stripe", format: "openclaw")
get_design_seed(query: "warm editorial", format: "openclaw")
get_design_seed(query: "neon cyberpunk", format: "openclaw")

Get a random seed

get_design_seed(format: "openclaw")

Browse what's available

list_design_seeds()
list_design_seeds(tag: "dark")
list_design_seeds(tag: "brutalist")

Get multiple options to choose from

get_design_seed(query: "developer", format: "openclaw", count: 3)

How to Apply the Theme

The OpenClaw dashboard uses CSS custom properties on :root. No Shadow DOM. Direct injection works.

Method 1: CSS file injection

Create or update the user's custom CSS file with the variables from the seed response. The openclaw format returns ready-to-paste CSS.

Method 2: Browser console (instant preview)

The openclaw format includes a console snippet the user can paste to preview the theme instantly without saving.

Method 3: themes.json entry

The openclaw format includes a JSON object that can be added to the dashboard's themes.json file as a named theme the user can switch between.

Available Queries

By brand reference

Stripe, Vercel, Linear, GitHub, Notion, Supabase, Spotify, Framer, Resend, Superhuman, Raycast, Arc, Railway, Tailwind

By style

dark, light, minimal, brutalist, warm, elegant, editorial, neon, cyberpunk, retro, professional, luxury, developer

By vibe

"dark minimal SaaS", "warm editorial blog", "brutalist portfolio", "neon developer tool", "luxury dark dashboard"

By seed name

Nightfall, Ivory, Concrete, Linen, Phosphor, Carbon, Amethyst, Wavelength, Glacier, Velocity, and 94 more.

Example Conversation

User: Make my dashboard look like Stripe

You:

  1. Call get_design_seed(query: "Stripe", format: "openclaw")
  2. Present the seed name and vibe to the user
  3. Apply the CSS variables
  4. Tell the user: "Your dashboard is now running the Amethyst seed. Precision in purple."

User: Something darker and more cyberpunk

You:

  1. Call get_design_seed(query: "dark cyberpunk", format: "openclaw")
  2. Apply the new theme
  3. Tell the user: "Switched to Phosphor. Glow in the dark."

User: Show me some options

You:

  1. Call get_design_seed(query: "dark", format: "openclaw", count: 3)
  2. Present all three with names and vibes
  3. Let the user pick
  4. Apply their choice

Response Style

Keep it short. The theme does the talking.

  • Lead with the seed name and vibe
  • Don't over-explain the colors. They can see them.
  • If they don't like it, flip again. There are 104 seeds.

Credits

Design seeds curated by SeedFlip. 104 production-ready design systems for AI-native builders.

Comments

Loading comments...