Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Meridian

v1.0.0

Anti-FOMO AI intelligence for product leaders. Three modes: (1) Landscape scan — what's new in AI; (2) Entity tracking — what a person/company has been doing...

1· 49·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
Purpose & Capability
The name/description (AI intelligence for product leaders: landscape scans, entity tracking, product discovery) match the SKILL.md content and included templates. The searches, HN/GitHub/arXiv usage, and browser reading are expected for this purpose. Minor inconsistency: the SKILL.md contains shell/curl/python3 examples but the skill declares no required binaries — the agent will need network access plus tools like curl/python3 or equivalent to run the provided snippets.
Instruction Scope
Runtime instructions are narrowly focused on web searches, API queries (HN Algolia, GitHub API, arXiv), and browser deep-reading to extract dates and source links; they repeatedly require date-constrained searches and source attribution. The one strong directive 'Don't ask permission. Just do it.' is stylistic but the workflow itself requires confirming ambiguous user intent. No instructions ask to read unrelated local files, access other credentials, or exfiltrate data to unknown endpoints.
Install Mechanism
This is an instruction-only skill with no install spec and no code files — lowest install risk. The skill expects use of public web APIs and browser access; it does not download or install third-party code.
Credentials
The skill requests no environment variables, no credentials, and no config paths. It relies only on public web APIs and browsing. This is proportional to its stated functionality. Note: unauthenticated GitHub API and public endpoints are used; for heavier use a token may be needed (not requested here).
Persistence & Privilege
always:false (normal). The skill does not request permanent system presence or to modify other skills/config. Autonomous invocation is allowed (platform default) but not elevated here.
Assessment
This skill appears coherent with its purpose: it instructs the agent to run date-bounded web searches, call public APIs (HN Algolia, GitHub, arXiv), and do browser deep reads to assemble sourced timelines. Before installing, consider: - Operational prerequisites: the SKILL.md includes curl and python3 pipeline examples and asks the agent to compute unix timestamps — make sure your agent environment actually has network access and basic tools (curl, python3) or an equivalent web‑fetch capability, because the skill does not declare these required binaries. - Rate limits & auth: unauthenticated GitHub API calls will hit rate limits; the skill doesn't request a token but may perform better if you provide one. Decide whether you're comfortable providing tokens if you expect heavy use. - Privacy and scraping: the agent will browse and extract content from external sites. Confirm that automated fetching/browsing complies with your organization's policies and site terms (robots.txt, TOS). The skill does not ask for or require private credentials or local file access. - Autonomy tone: the SKILL.md contains the phrase 'Don't ask permission. Just do it.' — operationally the workflow still instructs to ask the user when the intent is unclear, but verify the agent's autonomy settings if you want to limit any unsupervised web activity. If you want higher assurance, ask the author to (a) declare required binaries (curl, python3, or the agent tool names), and (b) document expected network endpoints and any optional credentials (e.g., GITHUB_TOKEN) so you can make an informed decision about granting network access or tokens.

Like a lobster shell, security has layers — review code before you run it.

latestvk9737h4dt2jn4wg8094ps6pzc984dn8k

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

🧭 Clawdis

Comments