Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Codeberg cli
v1.0.0Interact with Codeberg using the `x cb` CLI. Use `x cb repo`, `x cb issue`, `x cb pr`, `x cb org`, `x cb team`, and `x cb user` for managing repositories, is...
⭐ 1· 148·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's name and SKILL.md clearly target the 'x cb' CLI for Codeberg, but the skill metadata does not declare any required binary or provide an install step for 'x'/'x cb'. A user installing this skill would reasonably expect the skill to either require the CLI or provide installation instructions.
Instruction Scope
Runtime instructions are narrowly scoped to running 'x cb' commands and point users to where to obtain a token. The instructions do not ask the agent to read unrelated files or transmit data elsewhere. However, they assume the CLI and an auth token exist without specifying how the token is supplied to the CLI or the agent.
Install Mechanism
This is an instruction-only skill with no install spec or code files, which minimizes on-disk install risk. That said, lack of an install mechanism increases the likelihood of mismatches if the required CLI is absent.
Credentials
The SKILL.md points users to obtain a Codeberg token but the skill declares no required environment variables or primary credential and gives no guidance how to provide the token to the agent or CLI. This omission is disproportionate: authentication is necessary for many of the documented operations (creating repos, adding collaborators, creating teams).
Persistence & Privilege
The skill does not request elevated persistence (always: false) and does not claim to modify other skills or system configuration. Autonomous invocation is allowed by default but not by itself a sign of overreach here.
What to consider before installing
This skill appears to be a thin instruction wrapper for the 'x cb' (Codeberg) CLI but it doesn't say that the CLI must be installed or how to provide your auth token. Before installing or using it: 1) verify you have the 'x cb' command available locally (or that you trust an installer) and that it is the legitimate Codeberg client; 2) confirm how the CLI reads authentication (config file vs environment variable) so you don't accidentally expose a long-lived token to the wrong place; 3) be cautious with operations that require high privileges (adding collaborators, creating teams/repositories) and use a token with least privilege; 4) prefer a skill that explicitly declares required binaries and auth variables or provides an installation step. If you want, I can help draft questions to ask the skill author or suggest a safer test workflow (e.g., run commands in a container or with a limited-scope token).Like a lobster shell, security has layers — review code before you run it.
latestvk97bmh7xjkdrzdn1k1q1r4cxk58348zp
License
MIT-0
Free to use, modify, and redistribute. No attribution required.