Crayfish Plugin Assistant

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent instruction-only assistant for creating OpenClaw plugin scaffolds and developer commands, with no evidence of hidden code, credential use, or automatic execution.

This skill appears safe to install as an instruction-only plugin-development helper. Before using generated commands, read them carefully, run them in the intended project directory, keep a backup or version-control checkpoint, and treat publish commands as high-impact actions.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

If a user runs generated commands without checking them, they could modify their development environment or publish the wrong package.

Why it was flagged

The skill is designed to generate copy-pasteable developer commands, including install and publish commands. This is central to the stated plugin-development purpose, but such commands can change a local project or publish artifacts if a user runs them.

Skill content

给出一键安装命令和回滚命令。 ... 安装命令： ... 调试命令： ... 发布命令： ... 回滚命令： ... 命令可直接复制执行。

Recommendation

Review generated commands and files before execution, use version control, and confirm package names and publish targets before running any publish step.