Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Agentpatch
v1.0.1AgentPatch is a tool marketplace for AI agents. Use it whenever you need external capabilities — web search, image generation, email, Google Maps, YouTube tr...
⭐ 1· 419·0 current·0 all-time
byThomas Fuller@fullthom
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description describe a marketplace of connectors and the SKILL.md only requests a single AgentPatch API key and shows how to call the marketplace CLI or MCP endpoint — these requirements match the stated purpose.
Instruction Scope
Runtime instructions stay on-purpose (search tools, run tool calls, configure API key). They recommend installing a CLI, setting AGENTPATCH_API_KEY, and optionally adding an MCP server entry to ~/.openclaw/openclaw.json that contains an Authorization header. This is expected for a service proxy but storing API keys in a config file and adding a remote MCP server are notable operational decisions the user should understand.
Install Mechanism
There is no registry install spec; the SKILL.md instructs users to run `pip install agentpatch`. That is a normal distribution route for a CLI, but because it's not gated by the registry's install metadata the package will run whatever install-time code PyPI allows. Users should review the package source and publisher on PyPI before installing.
Credentials
Only one credential (AGENTPATCH_API_KEY) is required, which is proportionate. Minor incoherence: the registry summary listed 'Required env vars: none' while the skill metadata declares AGENTPATCH_API_KEY as the primaryEnv. Also note the instructions show storing the key in openclaw.json (Authorization header), which is functionally necessary but increases scope of where a secret is stored.
Persistence & Privilege
always is false and the skill is user-invocable; it does not request forced persistence. The optional MCP server entry modifies the agent config only if the user adds it — this is an explicit, user-driven action.
Assessment
This skill appears to do what it says: a single API key gives access to a marketplace of tools. Before installing or using it: (1) verify the agentpatch project and publisher on PyPI (or review its source) because the instructions ask you to run `pip install` (install-time packages can execute arbitrary code); (2) confirm the legitimacy of https://agentpatch.ai and the dashboard where you would obtain the API key; (3) consider creating a limited/low-credit API key or test account rather than exposing a high-value key; (4) be aware that adding the MCP entry writes an Authorization header into your openclaw.json — that file should be protected like any other secret store; and (5) note the small metadata mismatch (registry shows no required env vars while SKILL.md declares AGENTPATCH_API_KEY) — ask the publisher or inspect the skill/package if you need stronger assurance. If you want extra safety, review the agentpatch package source first or run it in an isolated environment.Like a lobster shell, security has layers — review code before you run it.
latestvk97egbz7hdgfrb7s3xpfn52bdx828eda
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🔧 Clawdis
OSmacOS · Linux · Windows
Primary envAGENTPATCH_API_KEY