Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Coworking Spaces
v0.1.0Find nearby coworking spaces. Invoke when user asks for shared offices near me.
⭐ 0· 56·0 current·0 all-time
byClawKK@codekungfu
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims to return nearby coworking POIs, but provides no mechanism for obtaining that data (no API endpoints, no web-scrape instructions, no built-in dataset). A skill that performs POI lookup would normally declare required API keys or an explicit provider; the absence of any data-source or credential requirement is incoherent with the stated capability.
Instruction Scope
SKILL.md defines inputs/outputs and privacy guidance, which is appropriate, but it references an absolute local file URI (file:///Users/mac_lkm/.../STANDARD_RESPONSE.md). That implies the skill expects access to a developer's local filesystem or another repo file that won't exist for most users. The instructions also do not state what external endpoints (maps, directories) to query or how to fetch POIs, leaving the agent broad discretion to choose data sources.
Install Mechanism
Instruction-only skill with no install spec and no code files — lowest install risk. Nothing written to disk or downloaded by the skill itself.
Credentials
The skill declares no environment variables or credentials. However, returning live POIs normally requires API keys (e.g., Google Maps, Foursquare, OpenStreetMap providers) or at least a documented data source. The lack of declared credentials is unexpected and could mean the agent will attempt to use general web access or built-in browsing instead—this should be clarified.
Persistence & Privilege
always:false and no special system/config modifications requested. The skill does not request persistent presence or elevated privileges.
What to consider before installing
This skill's goal (find coworking spaces nearby) is reasonable, but the runtime instructions are incomplete. Before installing or using it, ask the author: (1) What data source(s) does the skill use to get POIs? Will it call Google Maps, Foursquare, OpenStreetMap, or another API? (2) If it uses an external API, what credentials will be required and how will they be stored? (3) Why does the SKILL.md reference a local file path (STANDARD_RESPONSE.md) that likely doesn't exist in your environment? Practical risks: the agent may attempt arbitrary web queries or call third-party APIs without explicit credential declarations, and the local file reference could cause failures or unexpected behavior. If you need to proceed, require the skill author to document the provider(s), any required API keys, and replace local file references with an included schema or a stable URL.Like a lobster shell, security has layers — review code before you run it.
latestvk975bjkyvqb2qdake3gznn192s83em47
License
MIT-0
Free to use, modify, and redistribute. No attribution required.