Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Puzzle

Puzzle - command-line tool for everyday use

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 38 · 0 current installs · 0 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The SKILL.md and description advertise a 'puzzle generator' (crosswords, sudoku, word search, logic puzzles). The provided script, however, primarily implements a local logging/CLI framework that records commands and text to files under ~/.local/share/puzzle — there is no evidence of puzzle generation logic. There is also a version mismatch (registry metadata version 1.0.2 vs SKILL.md/script v2.0.0) and SKILL.md documents a PUZZLE_DIR env var but the script does not honor it. These inconsistencies suggest the declared purpose does not match the actual capability.
Instruction Scope
SKILL.md instructs normal CLI usage and points to storing data under ~/.local/share/puzzle. The script performs file I/O within that data directory only (creates logs, writes entries, exports). It does not access network endpoints or other system paths in the visible portion. Important note: the script will persist any user-provided input to local log files (history.log and many <command>.log files), so secrets typed to the tool would be stored. Also the SKILL.md claims PUZZLE_DIR configuration but the bundled script ignores that variable and instead uses $HOME implicitly.
Install Mechanism
No install spec is provided (instruction-only), so nothing will be downloaded or installed by an installer. A script file is included in the bundle; that file would run when invoked but there is no network download or archive extraction in the install metadata — this is low installation risk. (Full script was truncated in the provided input; no install-time network calls are visible in the shown content.)
Credentials
The skill declares no required environment variables or credentials, which is consistent with the script's local-only behavior. However, SKILL.md suggests setting PUZZLE_DIR to change the data directory; the included script does not read PUZZLE_DIR and always uses $HOME/.local/share/puzzle, so the documentation and implementation are out of sync. The script relies on standard environment variables like HOME (normal) but does not request secrets or external tokens.
Persistence & Privilege
The skill does not request 'always' privilege and does not modify other skills or system-wide settings in the visible code. It only writes and reads files under its own data directory. There is no evidence it elevates privileges or persists beyond its own data files.
What to consider before installing
This skill appears inconsistent: it advertises puzzle-generation features but the bundled script mostly implements a local logging/CLI tool and does not honor the documented PUZZLE_DIR. Before installing, consider the following: (1) Inspect the complete script (the provided file was truncated) to ensure there are no hidden network calls or unexpected behavior. (2) Understand that any text you send to the tool (commands/inputs) will be stored unencrypted in ~/.local/share/puzzle — avoid entering passwords or sensitive data. (3) The source and homepage are untrusted/absent; prefer packages with a verifiable origin or contact the maintainer for clarification. (4) If you still want to try it, run it in a sandboxed environment or container and/or change file permissions or move the data directory to a controlled location after confirming the script honors such configuration. If the mismatch about intended functionality (generator vs logger) is important to you, request a clearer implementation or proof of puzzle-generation features from the author before use.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.2
Download zip
latestvk97c4th7bhhw5fnm3t16bn1ck5830k1b

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Puzzle

Puzzle generator — crosswords, sudoku, word search, and logic puzzles.

Commands

CommandDescription
puzzle helpShow usage info
puzzle runRun main task
puzzle statusCheck state
puzzle listList items
puzzle add <item>Add item
puzzle export <fmt>Export data

Usage

puzzle help
puzzle run
puzzle status

Examples

puzzle help
puzzle run
puzzle export json

Output

Results go to stdout. Save with puzzle run > output.txt.

Configuration

Set PUZZLE_DIR to change data directory. Default: ~/.local/share/puzzle/


Powered by BytesAgain | bytesagain.com Feedback & Feature Requests: https://bytesagain.com/feedback

Features

  • Simple command-line interface for quick access
  • Local data storage with JSON/CSV export
  • History tracking and activity logs
  • Search across all entries

Quick Start

# Check status
puzzle status

# View help
puzzle help

# Export data
puzzle export json

How It Works

Puzzle stores all data locally in ~/.local/share/puzzle/. Each command logs activity with timestamps for full traceability.

Support

Powered by BytesAgain | bytesagain.com | hello@bytesagain.com

Files

2 total
Select a file
Select a file to preview.

Comments

Loading comments…