Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Clawshorts Pkg
v1.0.4Block YouTube Shorts on Fire TV. Use when asked to check, manage, or configure YouTube Shorts limiting on Buck's Fire TV devices. Triggers on requests like "...
⭐ 0· 46·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (block YouTube Shorts on Fire TV) aligns with the included code: ADB-based daemon, detection logic, and SQLite state. However the registry metadata claims no required binaries/env but the SKILL.md and scripts clearly require adb and Python and expect a symlink /opt/homebrew/bin/shorts — this metadata omission is inconsistent and surprising.
Instruction Scope
The SKILL.md and scripts instruct the agent/user to run local scripts that: connect to devices over ADB, dump UI XML, force-stop apps, create a symlink in /opt/homebrew/bin, write a LaunchAgent plist (~/Library/LaunchAgents) or systemd unit, and manage a local SQLite DB under ~/.clawshorts. All of these actions are coherent with the stated purpose but they give the skill broad control of local system files and persistent startup behavior and require enabling ADB on target devices (which the docs warn about).
Install Mechanism
There is no formal install spec in the registry, yet the package includes many code files and provides manual install steps that write files, create symlinks (potentially requiring sudo), and register LaunchAgents/systemd units. The absence of a declared install mechanism in metadata vs. presence of executable scripts is a packaging/integrity concern — users may be surprised that files will be created and autostart configured.
Credentials
The skill requests no cloud credentials or unrelated environment variables. All data it uses is local (ADB to on‑network Fire TV IPs, local SQLite under ~/.clawshorts). This is proportionate to its functionality. Note: enabling ADB gives the host machine powerful control of the TV device (expected for this use case).
Persistence & Privilege
The skill/installation will create persistent components: a daemon, optional LaunchAgent or systemd unit, and a healthcheck sidecar that can kill/restart the daemon. always:false is set, but installing the skill (via its provided install actions) grants it persistent autostart on the user's account. Users should be aware this will run continuously and can restart/kill processes on the machine.
What to consider before installing
This package appears to implement the advertised YouTube-Shorts limiting functionality (it uses adb to inspect the Fire TV UI, tracks usage in ~/.clawshorts/clawshorts.db, and force-stops the YouTube app when limits are reached). Important things to consider before installing:
- Metadata mismatch: the registry lists no required binaries, but the SKILL.md and scripts require Python 3 and adb (Android platform tools). The package will also attempt to create a symlink at /opt/homebrew/bin/shorts and install a LaunchAgent/systemd service — these actions may require elevated permissions or modify your login services.
- Persistence: the install path writes files under your home directory and configures autostart (~/Library/LaunchAgents or ~/.config/systemd/user). If you later uninstall, verify those files are removed.
- ADB risks: enabling ADB on a Fire TV grants remote control of that device. Only enable ADB on trusted networks and understand that adb connect will open a network-accessible control channel to the device.
- Review before running: because the package includes executable scripts that call adb, launchctl/systemctl, and pkill, you should inspect the files locally (they are present in the bundle) and run them in a controlled environment first. If you prefer least privilege, run the daemon manually without installing the auto-start components, or run in an account/container you can easily roll back.
- If you want to proceed: ensure adb and Python are installed, read the install/uninstall steps in README/TROUBLESHOOTING, and confirm the created symlink and LaunchAgent are acceptable. If unsure, ask the publisher for a formal install spec and clarification of why registry metadata omitted runtime binary requirements.Like a lobster shell, security has layers — review code before you run it.
latestvk9793qv522r699m4zan6tvrx5983jprz
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
