Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Flip

Generate flip UI elements and design assets. Use when building interfaces, creating visual components, or styling web pages.

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 19 · 0 current installs · 0 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
high confidence
Purpose & Capability
SKILL.md and package description advertise generating UI elements and design assets, but the included script only provides a local entry-management CLI (add/list/search/export) that reads/writes JSONL in ~/.flip. There is no code to generate images, components, or interact with design services — either the README is misleading or the implementation is incomplete.
Instruction Scope
Runtime instructions simply call scripts/script.sh with the listed commands. The script only accesses the data directory ($FLIP_DIR or ~/.flip) and standard shell utilities (grep, sed, tail, etc.). It does not call external network endpoints, read unrelated system files, or access undeclared environment variables.
Install Mechanism
No install spec is provided (instruction-only with a bundled script). Nothing is downloaded or written to system locations during installation by the registry metadata — low-install risk. The script would run from the skill bundle when invoked.
Credentials
No credentials or secret environment variables are required. One optional env var (FLIP_DIR) is documented and used to choose the data directory; that is proportionate to the script's behavior.
Persistence & Privilege
always:false and no elevated privileges requested. The skill only writes to its own data directory (~/.flip) and a config file within it; it does not modify other skills or system-wide settings.
What to consider before installing
This skill is internally coherent from a security/privilege perspective (no network calls, no credentials), but the advertised purpose does not match the implementation: the script is a local note/entry manager that stores JSONL under ~/.flip — it does not generate UI assets or call design tools. Before installing, decide whether you intended a designer/asset-generator or a simple local datastore. Note also: data is stored unencrypted in ~/.flip (and export creates files in the current working directory), so avoid storing sensitive information there. The script performs simple string extraction using grep/cut (not robust JSON handling), so entries containing quotes or newlines can break parsing; inspect the script locally, run it in a sandbox, and verify the GitHub/homepage source if you need true asset generation functionality.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.0
Download zip
latestvk970f11wehjrq5v2mc9wwzyk4s839375

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

flip

Generate flip UI elements and design assets. Use when building interfaces, creating visual components, or styling web pages.

Commands

status

scripts/script.sh status

Show current status

add

scripts/script.sh add

Add new entry

list

scripts/script.sh list

List all entries

search

scripts/script.sh search

Search entries

remove

scripts/script.sh remove

Remove entry by number

export

scripts/script.sh export

Export data to file

stats

scripts/script.sh stats

Show statistics

config

scripts/script.sh config

View or set config

help

scripts/script.sh help

version

scripts/script.sh version

Configuration

Use scripts/script.sh config <key> <value> to set preferences.

VariableRequiredDescription
FLIP_DIRNoData directory (default: ~/.flip/)

Data Storage

All data stored in ~/.flip/ using JSONL format (one JSON object per line).

Output

Structured output to stdout. Exit code 0 on success, 1 on error.


Powered by BytesAgain | bytesagain.com | hello@bytesagain.com

Files

2 total
Select a file
Select a file to preview.

Comments

Loading comments…