Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Skills Backup Claw Shell
v1.0.0Executes shell commands inside a dedicated tmux session named claw, capturing and returning the command output safely.
⭐ 0· 700·7 current·8 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The skill's code and SKILL.md both focus on running shell commands inside a tmux session named 'claw', which is coherent with the stated purpose. However the package does not declare that the tmux binary is required (required binaries list is empty) even though handler.js calls tmux repeatedly — that is an inconsistency the author should fix.
Instruction Scope
SKILL.md instructs the agent to ask the user for confirmation before running dangerous commands, but the implementation (claw_shell_run) returns an error when it detects a 'dangerous' command instead of prompting. The dangerous-command detection is also naive (simple substring matches like ' rm ' or 'sudo') and can be bypassed or produce false positives. The skill executes arbitrary user-supplied shell commands inside the tmux session, so any weaknesses in detection/confirmation behavior materially affect safety.
Install Mechanism
This is an instruction-only skill with no install spec, so nothing is downloaded or written during install. That minimizes install-time risk. Runtime does, however, depend on the system having tmux available (not declared).
Credentials
The skill requests no environment variables or credentials, which is proportionate to its stated purpose. There is no evidence it attempts to access unrelated secrets or config paths.
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and does not attempt to persist credentials. It runs on demand and so its privilege/presence level is reasonable.
Scan Findings in Context
[child_process_execSync] expected: handler.js uses node:child_process.execSync to run tmux commands and capture output. For a tmux-based shell tool this is expected, but execSync executes commands on the host and should be treated as privileged at runtime.
[naive_danger_detection] unexpected: The isDangerous function uses simple substring checks (e.g., ' sudo', ' rm ') which are easy to evade (e.g., 'rmdir', 'sudoo', spaced/no-space variants). SKILL.md promises an explicit user confirmation workflow for dangerous commands; the implementation instead returns an error and does not implement a confirmation flow.
What to consider before installing
This skill runs arbitrary shell commands inside a tmux session named 'claw'. Before installing or using it: (1) confirm the host has tmux and ask the author to list tmux as a required binary; (2) understand that the skill executes whatever you pass to it — do not use it on systems with sensitive data or where untrusted users can provide commands; (3) the dangerous-command check is simple and can be bypassed, and the code returns an error instead of prompting as the README suggests — treat it as not enforcing confirmation by itself; (4) if you need safer behavior, request the author add robust parsing, explicit interactive confirmation, and/or a command allowlist and declare required binaries. If you lack confidence in those fixes, consider not installing or running the skill on production/privileged machines.Like a lobster shell, security has layers — review code before you run it.
latestvk97fg070twb97h3166s5ph1j1s8192ws
License
MIT-0
Free to use, modify, and redistribute. No attribution required.