Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Trivia

Trivia - command-line tool for everyday use

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 32 · 0 current installs · 0 all-time installs
byBytesAgain2@ckchzh
MIT-0
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The declared purpose ('Trivia - command-line tool') matches the included script which implements a CLI that stores logs under ~/.local/share/trivia. However there are metadata mismatches: registry metadata version is 1.0.1 while SKILL.md and the script claim v2.0.0, SKILL.md references a homepage and feedback URL but registry lists none, and SKILL.md lists some commands (e.g., list, add) that do not appear in the script. These are consistency issues but not direct indicators of malicious behavior.
!
Instruction Scope
SKILL.md instructs users to set TRIVIA_DIR to change the data directory, but the shipped script ignores TRIVIA_DIR and hardcodes DATA_DIR to ${HOME}/.local/share/trivia. SKILL.md and the script also have different command names and examples. The script only reads/writes local files and logs; it does not make network calls, but the mismatch between docs and code means the agent or user could be given incorrect expectations about where data will be stored.
Install Mechanism
There is no install spec (instruction-only), and the code is a single shell script included in the bundle. No external downloads or package installs are requested, which minimizes install-time risk.
Credentials
The skill declares no required environment variables or credentials. SKILL.md suggests a TRIVIA_DIR env var for configuration, but the script does not use it; this inconsistency means the skill will always write to the user's home data dir unless manually edited.
Persistence & Privilege
The skill does not request elevated privileges, does not set always:true, and does not modify other skills or global agent settings. It stores data under the user's home directory only.
What to consider before installing
This skill appears to be a small local CLI that writes logs under ~/.local/share/trivia and does not perform network activity, but the packaging is inconsistent (mismatched versions, docs vs code, and an advertised TRIVIA_DIR env var that is ignored). Before installing or running it: (1) verify the script contents yourself and confirm the data directory path is acceptable, (2) run it in a sandbox or non-critical account to observe created files, (3) if you expect configurable storage, update the script to honor TRIVIA_DIR (or contact the author), and (4) prefer packages with clear provenance/hosting rather than unknown sources. Because of the inconsistencies, treat this as untrusted until validated.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.1
Download zip
latestvk973nxxvdt71y5mbt7x3yn87m983067t

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Trivia

Trivia toolkit — question banks, quiz rounds, scoring, and category management.

Commands

CommandDescription
trivia helpShow usage info
trivia runRun main task
trivia statusCheck state
trivia listList items
trivia add <item>Add item
trivia export <fmt>Export data

Usage

trivia help
trivia run
trivia status

Examples

trivia help
trivia run
trivia export json

Output

Results go to stdout. Save with trivia run > output.txt.

Configuration

Set TRIVIA_DIR to change data directory. Default: ~/.local/share/trivia/


Powered by BytesAgain | bytesagain.com Feedback & Feature Requests: https://bytesagain.com/feedback

Features

  • Simple command-line interface for quick access
  • Local data storage with JSON/CSV export
  • History tracking and activity logs
  • Search across all entries

Quick Start

# Check status
trivia status

# View help
trivia help

# Export data
trivia export json

How It Works

Trivia stores all data locally in ~/.local/share/trivia/. Each command logs activity with timestamps for full traceability.

Support

Powered by BytesAgain | bytesagain.com | hello@bytesagain.com

Files

2 total
Select a file
Select a file to preview.

Comments

Loading comments…