Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Corvus
v2.3.0Exploratory pattern analysis engine for the system knowledge graph and skill journals. Detects routines, emerging interests, anomalies, stalled threads, and...
⭐ 0· 141·0 current·0 all-time
byIndigo Karasu@indigokarasu
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description, command list, and declared filesystem read/write (chronicle and journals) align with an exploratory analysis engine that needs graph and journal data and emits proposals to intake directories for Praxis/Vesper.
Instruction Scope
SKILL.md instructs the agent to read journals and Chronicle, persist JSONL journals, write BehavioralSignal and InsightProposal files to other skills' intake directories, and run periodic analysis cycles. Those actions are within the stated scope, but the doc also describes initialization that registers cron jobs and heartbeat entries and a self-update command — actions that alter scheduled behaviour and fetch remote updates, which broaden the runtime authority of the skill.
Install Mechanism
There is no formal install spec in the registry (the package is instruction-only), but SKILL.md contains an 'install' line and README/cmds reference 'corvus.update' and 'openclaw skill install https://github.com/indigokarasu/corvus'. That means the skill expects or encourages pulling code from GitHub at runtime; fetching and executing external code is higher risk and should be reviewed before allowing.
Credentials
No environment variables or external credentials are requested. The declared filesystem reads (Chronicle DB and journals) and writes (its own data and journals, and other skills' intake dirs) are consistent with the stated functionality, though the read of '~/openclaw/journals/*/' is broad and will expose many journals to analysis.
Persistence & Privilege
The skill claims it will register cron jobs and heartbeat entries and perform self-updates from GitHub. While always:false, this persistent scheduled behavior and remote update capability increases its long-term privilege and blast radius — these operations modify runtime scheduling and can change code later, so they require explicit vetting and user consent.
Scan Findings in Context
[unicode-control-chars] unexpected: Scanner detected unicode-control characters in SKILL.md; this is commonly used in prompt-injection attempts to manipulate evaluators or LLMs. It is not necessary for a pattern-analysis README and should be investigated in the source text.
What to consider before installing
Corvus appears to do what it says (reading the knowledge graph and journals and writing structured proposals), but there are a few things to check before installing:
- Source verification: SKILL.md references a GitHub repository and the README says it will self-update. Manually review the referenced GitHub repo (code, install scripts, and update mechanism) before running any 'openclaw skill install' or allowing updates. The registry entry has no homepage and an opaque owner ID — confirm repository ownership and review commits/tags.
- Remote code fetch: The skill encourages pulling code from GitHub at 'corvus.update' and via the install line. That means new code can be introduced later. Only permit that if you trust the repository and have reviewed the install/update process.
- Scheduled tasks & persistence: The README claims it will register cron jobs/heartbeat entries. Confirm which scheduler is modified and ensure you control/approve those changes. If you prefer, disable automatic scheduling and run analysis manually until you vet behavior.
- Prompt-injection signal: The SKILL.md contained unicode-control characters flagged by the scanner. Treat that as suspicious — inspect the raw SKILL.md for hidden characters or instructions that could manipulate LLM prompts or the agent runtime.
- Least privilege: If you proceed, restrict filesystem permissions to only the necessary directories (Chronicle and the specific intake/journal paths) and avoid granting broader system access. Monitor created files and scheduled jobs after first run.
If you cannot inspect the GitHub source or confirm the update/install behavior, treat the skill as untrusted and do not install it. If you do inspect and approve the repo, prefer a one-time manual install and disable automatic self-updates until comfortable.Like a lobster shell, security has layers — review code before you run it.
latestvk971h672bve8xxqye4ft7eatz183r03w
License
MIT-0
Free to use, modify, and redistribute. No attribution required.