Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Score

Score - command-line tool for everyday use

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 36 · 0 current installs · 0 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (a local score-tracking CLI) matches the script's behavior (local logging, exports, search, status). However there are clear mismatches: SKILL.md documents commands like `run`, `add`, `list` and an environment variable SCORE_DIR, while the actual script implements different subcommands (roll, score, rank, etc.) and does not read SCORE_DIR (it hardcodes DATA_DIR using HOME). Version metadata also differs (registry v1.0.1 vs script v2.0.0). These inconsistencies could be benign (outdated docs) but reduce trust.
Instruction Scope
SKILL.md claims local storage in ~/.local/share/score and the script indeed writes and reads logs there; no instructions to access unrelated system files, credentials, or remote endpoints are present in the visible script. However SKILL.md promises configurable SCORE_DIR which the script does not honor — an instruction/scope mismatch. Also the provided script in the package was truncated in the review feed, so the tail of the script wasn't fully visible; that unknown portion could change the assessment.
Install Mechanism
No install spec; this is an instruction-only/embedded-script skill. Nothing is downloaded from external URLs and no packages are installed by the skill itself. Risk from install mechanism is low.
Credentials
The skill declares no required environment variables or credentials. The script implicitly uses HOME to build a path (normal for local CLI tools). SKILL.md references SCORE_DIR for configuration but the script does not accept it — either the docs are outdated or the script is incomplete, which is a proportionality/documentation concern rather than a data-exfiltration concern.
Persistence & Privilege
Skill does not request always:true, does not modify other skills, and stores data in a per-user directory (~/.local/share/score). It writes and reads files in that directory which is consistent with its purpose. No elevated privileges requested.
What to consider before installing
This package looks like a simple local CLI that writes logs and exports data to ~/.local/share/score and does not request credentials or network access. However: (1) the SKILL.md and the bundled script disagree about available commands and the SCORE_DIR configuration — the docs appear out of sync with the code; (2) the provided script content was truncated in the review feed, so the file's end should be inspected for any network calls or unexpected behavior before trusting it. Recommended steps before installing: manually open and read the entire scripts/script.sh file (verify it does not call curl/wget/ssh/netcat or similar), run the tool in a sandboxed account or container, and if you need configurable data location, patch the script to honor SCORE_DIR (or request an updated release). If you store sensitive data in your home directory, consider changing the DATA_DIR location and file permissions before use.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.1
Download zip
latestvk975wqp4qaj74yd3m24gr31qg5831k8b

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Score

Score tracker — game scores, tournament brackets, standings, and statistics.

Commands

CommandDescription
score helpShow usage info
score runRun main task
score statusCheck state
score listList items
score add <item>Add item
score export <fmt>Export data

Usage

score help
score run
score status

Examples

score help
score run
score export json

Output

Results go to stdout. Save with score run > output.txt.

Configuration

Set SCORE_DIR to change data directory. Default: ~/.local/share/score/


Powered by BytesAgain | bytesagain.com Feedback & Feature Requests: https://bytesagain.com/feedback

Features

  • Simple command-line interface for quick access
  • Local data storage with JSON/CSV export
  • History tracking and activity logs
  • Search across all entries

Quick Start

# Check status
score status

# View help
score help

# Export data
score export json

How It Works

Score stores all data locally in ~/.local/share/score/. Each command logs activity with timestamps for full traceability.

Support

Powered by BytesAgain | bytesagain.com | hello@bytesagain.com

Files

2 total
Select a file
Select a file to preview.

Comments

Loading comments…