Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

GSD Agent (→ gsd-orchestrator)

v1.0.0

Redirect — install `gsd-orchestrator` instead. This skill exists to reserve the name. The full orchestration skill with subprocess patterns, exit code handli...

0· 141·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for glittercowboy/gsd-agent.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "GSD Agent (→ gsd-orchestrator)" (glittercowboy/gsd-agent) from ClawHub.
Skill page: https://clawhub.ai/glittercowboy/gsd-agent
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: gsd
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install gsd-agent

ClawHub CLI

Package manager switcher

npx clawhub@latest install gsd-agent
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The SKILL.md states this is only a name reservation / redirect to gsd-orchestrator, yet the declared requirements include a binary 'gsd' and an install block pointing to a Node package 'gsd-pi'. A pure redirect does not need those requirements, so the declared capabilities don't fully align with the stated purpose.
Instruction Scope
Runtime instructions are just a redirect message and a single recommended install command for gsd-orchestrator; there are no instructions to read files, access env vars, or call external endpoints beyond the registry link.
Install Mechanism
SKILL.md contains an openclaw.install block (kind: node, package: gsd-pi). Pulling a package named 'gsd-pi' from a package registry is a moderate-risk action if performed, but the skill itself does not execute installs. The presence of this install metadata is unexpected for a placeholder/redirect skill and should be verified (package provenance, publisher).
Credentials
No environment variables, credentials, or config paths are requested — proportional to a lightweight redirect.
Persistence & Privilege
No elevated persistence requested (always:false); the skill is user-invocable and does not request persistent or cross-skill configuration changes.
What to consider before installing
This skill is essentially a placeholder that tells you to install gsd-orchestrator instead. Before proceeding: (1) prefer installing the recommended gsd-orchestrator skill rather than this one; (2) if you see an automatic install of a Node package named 'gsd-pi' or a requirement for a 'gsd' binary, verify the package publisher and registry source (it may be unnecessary for a redirect); (3) if you only need the redirect text, you can safely ignore installing this skill. If you plan to install anything (gsd-orchestrator or gsd-pi), confirm package provenance and that the binaries match the project's official distribution channels.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

Binsgsd
latestvk97echkyz8w1kx86ckhtdvr29n83n39t
141downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

gsd-agent → gsd-orchestrator

This is a name reservation. Install gsd-orchestrator instead.

The gsd-orchestrator skill provides complete subprocess-based orchestration patterns for GSD projects:

  • Milestone creation from specs
  • Task execution via gsd headless
  • Status polling and blocker handling
  • Cost tracking and budget enforcement
  • Exit code interpretation (0/1/10/11)
  • HeadlessJsonResult JSON parsing

Install the real skill

clawhub install gsd-orchestrator

Comments

Loading comments...