Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Growth Loop Orchestrator

v1.0.0

Orchestrate growth loops across the skill portfolio by connecting usage, feedback, improvement, and adoption into self-reinforcing cycles. Use when designing...

0· 215·0 current·0 all-time
byhaidong@harrylabsj
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
Purpose & Capability
The scripts (design-loop.sh, analyze-loops.sh, track-metrics.sh) implement loop design, analysis, and simulated metrics consistent with the skill's stated purpose. However the SKILL.md and README reference additional commands (optimize-loop.sh, generate-report.sh, simulate-loop.sh, generate-report.sh) that are not present in the file manifest, and the package does not declare required binaries (the scripts use shuf, bc and optionally jq).
!
Instruction Scope
Runtime instructions tell the agent to run shell scripts that write reports into a data/ directory (expected), but SKILL.md broadly states it 'accepts user behavior data' and 'skill portfolio information' — which could imply reading or aggregating other skills' data. The actual scripts do not access system or network resources, but the mismatch between instructions and included scripts (missing optimize/generate/simulate scripts) is a scope/integrity problem.
Install Mechanism
No install spec (instruction-only) and all code is bundled in the skill (no external downloads) — low install risk. Minor note: the manifest includes executable shell scripts but the package did not declare external dependencies (shuf, bc, jq) which may be required on target systems.
Credentials
The skill does not require credentials or config paths. Scripts accept an optional GROWTH_DATA_DIR environment variable (reasonable). No secrets or unrelated environment variables are requested.
Persistence & Privilege
always is false and the skill does not request broad or persistent platform privileges. The included test.sh may set executable bits on its own scripts, but the skill does not modify other skills or system-wide settings.
What to consider before installing
This package mostly does what its name says, but there are packaging and instruction inconsistencies you should resolve before installing or running it: - SKILL.md and README reference scripts that are missing (optimize-loop.sh, generate-report.sh, simulate-loop.sh). That could be sloppy packaging or an incomplete release — ask the author or inspect the repository for the missing files. - The included scripts use utilities (shuf, bc, jq) that were not declared as requirements; ensure your environment has these binaries or the scripts may fail. - Some bundled data files (e.g., data/METRICS-*.json) contain placeholder/malformed fields; this looks like template/sample data rather than live telemetry, but review any data files before publishing. - The content-design guidance includes 'Make outputs public by default'. If you plan to run this on real user data, confirm whether outputs will be published or exported externally — that could leak user content. The scripts as provided do not perform network uploads, but the documentation suggests publishing by default for content loops. Before installing or giving this skill access to real data, recommended steps: 1) Inspect the missing scripts or request a complete release from the author. 2) Run test.sh in a sandbox/local dev environment to see what files are written and verify no network activity. 3) Ensure required utilities (shuf, bc, jq) exist or update scripts to not require them. 4) If you will use real user/skill portfolio data, verify and control where outputs are published; avoid running with production data until you confirm publication behavior. Given these inconsistencies, treat the package as potentially incomplete or poorly packaged rather than actively malicious, but proceed cautiously.

Like a lobster shell, security has layers — review code before you run it.

latestvk972em7bxj7jghr0916bjrca7582t8js

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments