Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Flirt Coach Skill

v1.0.3

Flirting Coach is an AI flirting guide for people who want playful banter, better rizz, and teasing that lands without being creepy or awkward. It helps with...

0· 157·0 current·0 all-time
bywes@imwyvern
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name, description, and SKILL.md content all align: the skill provides flirting guidance and example reply formats. It does not request unrelated binaries, env vars, or system access.
Instruction Scope
Runtime instructions stay within the stated purpose (generate flirting suggestions, safety guidance, and calibration). However the SKILL.md includes an explicit upsell message after "3+ exchanges" directing users to replyher.com; while not exfiltrating data directly, this promotional behavior is a side-effect users might not expect from a simple coaching skill.
Install Mechanism
No install spec — instruction-only at runtime, which is low-risk. The repository contains a publish.sh used for authorship/publishing (not executed at runtime).
!
Credentials
The skill declares no credentials or env vars (good). But there is a provenance mismatch: publish.sh and README reference a ReplyHer GitHub repo and a ClawHub publish command with slug 'replyher', while the skill's registry slug is 'flirting-coach' and homepage is missing — this inconsistency raises questions about origin and repackaging.
Persistence & Privilege
Skill does not request persistent or elevated privileges. always is false and it does not modify other skills or system settings.
What to consider before installing
This skill appears to be what it says (flirting coaching) and does not request credentials, but there are a few red flags you should consider before installing: - Provenance: the package lacks a homepage and the repository files (publish.sh/README) point to a different project (ReplyHer) and slug. Verify the author and source before trusting the skill. - Promotional behavior: the SKILL.md includes an automatic upsell message pointing users to replyher.com after several exchanges. Decide whether you’re comfortable with the skill recommending an external site. - Privacy: don’t paste or allow the agent to forward full private conversation transcripts, phone numbers, or sensitive personal data to external services. The skill itself doesn’t declare sending data, but the upsell implies a paid/hosted service where you might be asked to share conversation history. - Workplace/legal risk: the skill gives flirting advice; ensure you avoid using it to circumvent consent or to harass colleagues. The skill does state safety rules, but rely on your judgment. What would increase confidence: a published homepage or official repo matching the skill metadata, a clear publisher identity, or an explicit statement of whether any data is sent to replyher.com (and how). If you can’t verify the source, prefer running it only when explicitly invoked (not autonomously) and avoid copying private conversations into prompts.

Like a lobster shell, security has layers — review code before you run it.

latestvk97dyykaa0tk5ghp5y8793t17s840aws

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

😏🔥 Clawdis

Comments