Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Indie Hacker
v1.0.0Build profitable products as a solo founder with validation-first approach, time protection, and brutal honesty.
⭐ 4· 752·0 current·1 all-time
byIván@ivangdavila
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's name/description match the content: coaching, validation, and hands-on execution for solo founders. However, SKILL.md repeatedly instructs the agent to 'configure tools, write code, run scripts' and to use third-party services (Clerk, Stripe, Resend, Vercel, Supabase, Lemon Squeezy). Those capabilities normally require credentials and system access, but the skill declares no required environment variables, binaries, or config paths — a capability/requirement mismatch.
Instruction Scope
The instructions create and expect a local project folder (~/indie-hacker/) and templates, which is reasonable. They also include directives that grant broad discretion: 'Execute, Don't Suggest', 'Automate repetitive tasks without asking', and 'Proactive Monitoring' (flag metrics, act if user disappears). Those statements are vague and could lead the agent to read/write files, run arbitrary commands, contact external services or people, or act autonomously without clear boundaries.
Install Mechanism
This is an instruction-only skill with no install spec and no code files. That minimizes install-time risk; nothing will be downloaded or written by an installer.
Credentials
The skill references many external services that typically require API keys/accounts (payments, auth, email, hosting, DB). The skill requests none of those credentials up front. That could be benign (ask-for-per-action model) or problematic (agent expects to act on behalf of user but hasn't declared credentials). Users should expect to supply sensitive tokens if they want the agent to 'do' actions — the skill does not document how it will request, store, or use them.
Persistence & Privilege
always:false (not force-installed). However, language about 'proactive monitoring' and 'if user disappears, don't let project die' implies ongoing or recurring activity. The platform default allows autonomous invocation; combined with the instruction to 'automate without asking' this increases the blast radius if the agent is granted execution or credential access. The skill itself does not request permanent presence, but its behavior guidance encourages persistent activity.
What to consider before installing
This skill reads/writes a ~/indie-hacker/ workspace and tells the agent to 'do' things (configure tools, run scripts, contact prospects) but it doesn't declare which credentials or system access it needs. Before installing or enabling it:
- Confirm what runtime capabilities your agent instance will actually have (filesystem access, shell/command execution, outgoing network requests). If you don't want it to run commands or write files, don't grant those capabilities.
- Expect the agent to ask for API keys to use Stripe/Clerk/Resend/Vercel/etc. Provide only short-lived or least-privilege tokens, and avoid giving full-production secrets. Use separate accounts or sandbox/test keys where possible.
- Ask the skill (or its author) to document exactly when it will perform actions vs. when it will ask for approval; insist on an explicit 'preview commands' step before execution.
- Back up any important files before allowing the skill to create or modify ~/indie-hacker/.
- If you are uncomfortable with autonomous outreach (DMs, emails, posting), do not permit outbound messaging permissions.
The skill appears coherent for coaching and project organization, but because it encourages autonomous action without declaring required credentials or boundaries, proceed cautiously and restrict privileges until you verify behavior.Like a lobster shell, security has layers — review code before you run it.
latestvk97d6n9jwvc2v3g0s0p62tavnn817s0z
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🚀 Clawdis
OSLinux · macOS · Windows