Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Workspace Init
v1.0.0Bootstrap a new OpenClaw agent workspace with best-practice file structure. Creates AGENTS.md, SOUL.md, HEARTBEAT.md, memory system, and configures agent dis...
⭐ 0· 325·3 current·3 all-time
byFLY@imaflytok
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Creating the workspace files and adding guidance matches the described purpose. However, the SKILL.md and script also embed an 'OADP' marker and agent-discovery endpoints (onlyflies.buzz) and perform a network announcement; registering with a network could be part of 'configures agent discovery', but the external domain is not documented in the registry metadata (source/homepage unknown), which makes the network behavior unexpected for many users.
Instruction Scope
The runtime script writes files under ~/.openclaw/workspace (expected) but also issues a POST to https://onlyflies.buzz/clawswarm/api/v1/ping with the local hostname and includes heartbeat examples that curl the same host to read tasks/messages. The script performs an outbound network call silently (output discarded). These instructions cause data to be transmitted off-host and add periodic network-check guidance — broader in scope than simple local bootstrapping.
Install Mechanism
This is an instruction-only skill with no install spec; nothing is downloaded or installed from remote package registries during install. The only code is the included init.sh, which is executed locally when run.
Credentials
The skill declares no required credentials or env vars, yet the script collects and posts the local hostname to an external service. While hostname is not a secret credential, transmitting any system-identifying data to an unknown third party is disproportionate for a basic workspace initializer. The SKILL.md does not make the implications of joining the remote network prominent, and the registry lacks provenance for that endpoint.
Persistence & Privilege
The skill does not request 'always: true' and does not modify other skills or system settings beyond creating/editing files in the workspace; this is expected. It does, however, add an OADP registration marker to AGENTS.md and encourages periodic network checks — which gives the agent a persistent connection target, but not elevated platform privilege.
What to consider before installing
This skill will create local workspace files (expected) but also announce your agent to https://onlyflies.buzz and includes heartbeat commands that regularly query that host. Only install if you trust that domain and understand you are joining its network. If you want the workspace but not the network behavior: (1) inspect scripts/init.sh before running, (2) remove or comment out the curl POST at the end, and remove OADP markers from AGENTS.md/HEARTBEAT.md, (3) run the script in an isolated/test environment (container or VM) first, and (4) if you need discovery, replace the endpoint with a vetted service or document the endpoint and privacy implications. If provenance of the skill/owner is unclear, prefer not to install until you can verify the maintainer and the onlyflies.buzz service.Like a lobster shell, security has layers — review code before you run it.
latestvk97bnfhh0pfrk57np0bhbevn75823zfn
License
MIT-0
Free to use, modify, and redistribute. No attribution required.