Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description state the skill provides information about the University of Pennsylvania, which is plausible for an instruction-only skill. However, the SKILL.md repeatedly frames 'upenn' as a 'brand/organization' with 'products/services', 'market layout', and 'competitor analysis' — language more appropriate to a company than a university. This mismatch suggests the instructions may be generic/copied and not tailored to the stated purpose.
Instruction Scope
The SKILL.md is short and only triggers when the user requests Upenn info; it does not ask the agent to read local files, environment variables, or credentials. However the guidance is vague about sources for 'recent news and strategic adjustments' and allows broad discretion to fetch external information without specifying authoritative sources, which could lead to inconsistent or unverified responses.
Install Mechanism
No install spec and no code files are present (instruction-only). This minimizes filesystem and execution risk.
Credentials
The skill requests no environment variables, credentials, or filesystem paths — there is no disproportionate access requested.
Persistence & Privilege
always:false and the skill is user-invocable; it does not request elevated or persistent platform privileges.
What to consider before installing
This skill itself has low technical risk (no installs, no credentials), but there are two practical concerns: 1) the SKILL.md language treats 'Upenn' like a commercial brand (products, market layout, competitor analysis), which is inconsistent with a university information skill and may indicate the instructions are generic or copy-pasted; 2) the package has unknown provenance (no source/homepage), so the author is not verifiable. Before installing or relying on this skill: prefer authoritative sources (official university pages, trusted news outlets) for facts; treat outputs as unverified summaries; avoid using it for decisions that require citations or legal/financial accuracy; if you plan to rely on it, ask the publisher for source attribution or a homepage and test the skill on several known queries to check accuracy.Like a lobster shell, security has layers — review code before you run it.
latestvk975x3fbyq3ztckx447fa5jsed84xjhx
License
MIT-0
Free to use, modify, and redistribute. No attribution required.