Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Vpn Proxy Manager
v1.0.0V2Ray代理管理 - 自动开关代理、根据网络状况自动配置系统代理 / V2Ray Proxy Management - Auto start/stop proxy based on network conditions
⭐ 0· 336·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The script's actions (start/stop V2Ray, set/clear system proxy, auto-check network, wrap commands) match the skill name and description. Minor mismatch: the metadata declares no required binaries, but the script relies on common utilities (curl, pgrep/pkill, nohup, pkill) and a local V2Ray/Xray binary; the README asks the user to edit V2RAY_DIR to point to a local installation.
Instruction Scope
SKILL.md simply instructs the agent/user to run the provided script. The script checks connectivity (curl to github.com/google.com), manages environment proxy variables, persists a marker to ~/.bashrc, launches/stops local binaries, and supports 'wrap' which runs arbitrary shell commands via eval — that last point grants the ability to execute any command the agent passes to the script (this is intended for the feature but expands execution scope).
Install Mechanism
No install spec; instruction-only skill with an included shell script. Nothing is downloaded or installed automatically by the skill.
Credentials
The skill requests no credentials and does not contact unknown remote endpoints (only checks github.com and google.com). It does, however, set proxy-related environment variables during execution and appends a V2RAY_PROXY line to the user's ~/.bashrc to persist a marker — this is environment modification but aligns with its purpose.
Persistence & Privilege
Although 'always' is false, the script modifies a user file (~/.bashrc) to persist V2RAY_PROXY, and it can start background processes (v2rayN/xray). Modifying shell startup files and launching background binaries are significant persistent actions the user should review and consent to.
Assessment
This skill appears to do what it says: control a local V2Ray/Xray proxy and toggle system proxy settings. Before installing or letting an agent run it:
- Manually inspect and edit scripts/v2ray-proxy.sh to set V2RAY_DIR to your V2Ray/Xray installation (ensure you trust that binary).
- Note the script expects utilities like curl, pgrep/pkill, nohup; ensure those exist in your environment.
- The script appends a line to ~/.bashrc; back up that file if you care about preserving your shell config.
- The 'wrap' command runs arbitrary shell commands via eval — do not allow untrusted agents or workflows to call wrap with unreviewed arguments.
- If you want less persistence, remove the ~/.bashrc write or change it to a safer mechanism. If you have an automated agent, restrict when/how it can invoke this skill (or require manual invocation) to limit unwanted command execution or environment changes.Like a lobster shell, security has layers — review code before you run it.
latestvk977cmj39hqxtnx1qknbsq9x9582bf8b
License
MIT-0
Free to use, modify, and redistribute. No attribution required.