Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Inngest
v1.0.0Manage Inngest serverless background jobs and event-driven workflows via REST API. Use when asked to send events, trigger functions, list runs, cancel jobs,...
⭐ 0· 41·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description match the SKILL.md: all examples are REST calls to inn.gs and api.inngest.com for sending events and managing runs. Behavior described in SKILL.md aligns with the stated purpose.
Instruction Scope
Instructions are limited to curl requests against inn.gs and api.inngest.com using two env vars and occasional $RUN_ID. They do not reference other files, system paths, or external endpoints beyond the Inngest domains.
Install Mechanism
This is an instruction-only skill with no install spec and no code files — nothing is written to disk and no external packages are fetched.
Credentials
The SKILL.md explicitly requires INNGEST_EVENT_KEY and INNGEST_SIGNING_KEY (sensitive secrets) but the registry metadata lists no required env vars or primary credential. Either the skill metadata is incomplete (likely) or the platform won't know to prompt for/store these secrets. Requesting signing keys is proportionate for this purpose, but the mismatch is an incoherence risk.
Persistence & Privilege
No special persistence or elevated privileges requested (always:false, no config paths, no modifications to other skills). Autonomous invocation is allowed by default but not combined with other red flags.
What to consider before installing
This skill appears to be a simple curl-based Inngest helper and is otherwise coherent, but the SKILL.md requires two secrets (INNGEST_EVENT_KEY and INNGEST_SIGNING_KEY) while the registry metadata declares none. Before installing: (1) confirm the platform will let you provide and securely store both env vars; (2) treat INNGEST_SIGNING_KEY as a sensitive secret — only provide it if you trust the skill and platform; (3) verify network calls are limited to inn.gs and api.inngest.com and that you won't accidentally send sensitive data in event payloads; (4) ask the publisher or registry maintainer to update the skill metadata to declare the required env vars and mark the signing key as the primary credential so the platform can surface appropriate warnings and secure storage. If you cannot provide the signing key securely, do not install or run this skill.Like a lobster shell, security has layers — review code before you run it.
background-jobsvk973qn33q7v7ma36k4narxjtfd83pnphevent-drivenvk973qn33q7v7ma36k4narxjtfd83pnphinngestvk973qn33q7v7ma36k4narxjtfd83pnphlatestvk973qn33q7v7ma36k4narxjtfd83pnphserverlessvk973qn33q7v7ma36k4narxjtfd83pnphworkflowsvk973qn33q7v7ma36k4narxjtfd83pnph
License
MIT-0
Free to use, modify, and redistribute. No attribution required.