ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Git Assistant

v1.0.0

AI-powered git commit messages, changelogs, release notes, PR descriptions, and commit review. Analyzes staged changes and git history to generate profession...

⭐ 0· 42·0 current·0 all-time
by@evolinkai
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
Requires OAuth tokenRequires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description, required binaries (python3, curl, git) and the required env EVOLINK_API_KEY line up with an AI-backed git workflow helper. The primary credential (EVOLINK_API_KEY) is appropriate for the claimed remote AI analysis.
ℹ
Instruction Scope
Runtime instructions and the bash script only read git state (staged diffs, names, logs) and send that truncated data to api.evolink.ai. They do not request unrelated credentials or read unrelated system files. Minor mismatch: SKILL.md asserts 'No files are written' at runtime, but the installer copies files into the user's workdir (see install.js) and the runtime creates temporary files (deleted via trap).
ℹ
Install Mechanism
Registry metadata said 'No install spec (instruction-only)', but the package includes an npm installer (npm/bin/install.js) that copies skill files into a discovered workdir and updates a .clawhub lock file — not a remote download. The installer writes files into the workspace (skills/ai-git-assistant and .clawhub), which is expected but worth noting.
✓
Credentials
Only EVOLINK_API_KEY is required (EVOLINK_MODEL optional). That is proportionate: AI features need an API key for the external service. No other unrelated secrets or cross-service credentials are requested.
ℹ
Persistence & Privilege
Skill does not request permanent 'always' privilege and does not attempt to change other skills. However installation will write files into the detected workdir and update .clawhub/lock.json and .clawhub-origin.json — the SKILL.md's runtime claim of 'no files are written' is inaccurate for the install step.
Assessment
This skill is internally consistent with being a git commit/changelog/PR helper that sends truncated diffs and commit logs to api.evolink.ai for analysis and requires an EvoLink API key. Before installing or using it, consider: (1) Data exposure — AI commands transmit repository diffs and commit history to a third-party service; do not send secrets or sensitive data in staged changes. (2) Installer behavior — the included installer copies files into your project/workdir and writes .clawhub lock/origin files; review the install.js and scripts/git-assist.sh yourself before running. (3) Origin verification — the registry source is listed as unknown; confirm the GitHub homepage and package author if you need provenance. (4) Least privilege — provide an EvoLink API key with only the permissions you intend and avoid putting long-lived credentials into shared CI or public environments. If any of these are unacceptable, inspect or run the scripts in an isolated repository or container first.

Like a lobster shell, security has layers — review code before you run it.

latestvk9735xzhn98dpcqjxrab4dp2hh84vm6s

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

Binspython3, curl, git
EnvEVOLINK_API_KEY
Primary envEVOLINK_API_KEY

Comments