Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Delivery Queue
v1.2.0Schedules and delivers segmented messages with timed delays and retries to simulate human-like communication and avoid spam detection.
⭐ 0· 84·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The name/description promise scheduling and 'delivery' (including avoiding WhatsApp spam detection). The provided script only manages a local JSON queue (schedule, list, cancel, mark as sent, clean). There is no code to integrate with WhatsApp, Telegram, email servers, or any external delivery API, nor does the skill request any credentials. Claiming end-to-end delivery while shipping only a local queue is a clear capability mismatch.
Instruction Scope
SKILL.md describes a background worker that sends messages at scheduled times and emphasizes timing to avoid spam detection, but no background worker or sending logic exists in deliver.sh. The skill asks the agent to compose split messages but does not specify how/where those segments are transmitted. The mention of avoiding spam detection is an operational/ethical red flag and not justified by any implementation detail.
Install Mechanism
There is no install spec; the script is small and writes queue files under OPENCLAW_HOME or ~/.openclaw. No remote downloads or package installs are requested, which keeps install risk low.
Credentials
The skill declares no required env vars or credentials (only optionally uses OPENCLAW_HOME to locate the queue). This is inconsistent with the claimed ability to send messages through external services (which would normally require API keys/tokens). The absence of credential requirements means the script cannot actually perform external deliveries.
Persistence & Privilege
The skill does not request always:true and does not modify other skills or system settings. It persists data only in a per-user directory (~/.openclaw/delivery-queue by default). Autonomous invocation is allowed by platform default but is not combined with elevated privileges here.
What to consider before installing
This skill is inconsistent: it claims to deliver messages (including WhatsApp/Telegram) and to evade spam detection, but the included code only queues JSON files and marks them as sent—there is no network/sending logic or credentials. Before installing, consider:
- Do you expect this skill to actually send messages? If so, it currently cannot; you would need a separate worker that calls real messaging APIs and would require API keys/tokens.
- Be cautious about the 'avoid spam detection' language—using timing to evade spam filters can violate platform policies and laws.
- Inspect any additional code you plan to add (the worker/sender) and only provide credentials to well-known APIs you trust.
- Because the script writes to ~/.openclaw, run it in a sandbox first and do not point it at real contact lists until you confirm its behavior.
If the author intends this only as a local queue manager, the README should be corrected to remove claims of actual delivery and anti-spam behavior and should document how to plug in a real sender and what credentials are required.Like a lobster shell, security has layers — review code before you run it.
latestvk97101s9w3jrp8nvzjgm8vk1a183kqqq
License
MIT-0
Free to use, modify, and redistribute. No attribution required.