ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

emoji and tg stickers use proactively based on mood

v3.0.0

Automatically send Telegram stickers and emojis that match the mood and vibe of the conversation. Activates on every Telegram message to add expressive, huma...

⭐ 4· 1.5k·4 current·4 all-time
byDaniil Burykin@dandysuper
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description match the code and SKILL.md: the skill only needs a TELEGRAM_BOT_TOKEN and uses the Telegram Bot API to send stickers. The requested credential is appropriate for the stated functionality.
ℹ
Instruction Scope
Instructions ask the agent to act proactively (send stickers without an explicit user request) and to use $TELEGRAM_CHAT_ID from the environment. This is behaviorally aggressive (could spam/annoy) but does not read unrelated files or secrets.
✓
Install Mechanism
No install spec; the only code is a small shell script that uses curl and python3. Nothing is downloaded from external, untrusted URLs and nothing is written to disk beyond the script itself.
✓
Credentials
Only TELEGRAM_BOT_TOKEN is required and is consistent with sending messages via the Bot API. No unrelated credentials, config paths, or broad secrets are requested.
ℹ
Persistence & Privilege
always is false (good). Model invocation is allowed (platform default), which means the agent can autonomously send stickers per the skill's instructions — combined with the proactive behavior this can lead to frequent unsolicited messages; consider limiting autonomous invocation if unwanted.
Assessment
This skill appears to do exactly what it says: it uses your TELEGRAM_BOT_TOKEN to call api.telegram.org and send stickers. Before enabling it: (1) ensure the bot token you provide has only the permissions you intend and rotate/revoke it if misused; (2) be aware the skill is explicitly designed to act proactively (it will send stickers automatically on messages) — if you don't want autonomous, unsolicited responses, disable autonomous invocation or require user confirmation; (3) test in a private chat or test group first to confirm behavior and rate limits; (4) you can inspect or modify scripts/send_sticker.sh if you want stricter logging, rate-limiting, or opt-out checks.

Like a lobster shell, security has layers — review code before you run it.

latestvk975e51get8vcxn0p9b2cbs48h8293zf

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎭 Clawdis
EnvTELEGRAM_BOT_TOKEN

Comments