Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Personal Knowledge Base
v1.0.1Help users build a personal knowledge base by organizing whatever they send into structured notes.
⭐ 4· 2.8k·12 current·14 all-time
byIván@ivangdavila
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (personal knowledge base) match the SKILL.md instructions: capturing incoming items, saving atomic Markdown notes, inbox processing, tagging, linking, and optional sync via git/cloud. No unrelated environment variables, binaries, or system-wide config are requested.
Instruction Scope
The instructions explicitly tell the agent to create and manage files under ~/kb/ (create inbox.md, move/delete items when processed), fetch URL titles/summaries, and use search tools (grep or other). These behaviors are coherent with the purpose but involve modifying the user's home filesystem and performing network fetches; the SKILL.md does not specify confirmation prompts, limits on what is fetched/stored, or details about how external content is fetched/stored. Users should expect local file write/delete and outbound HTTP activity when the skill runs.
Install Mechanism
Instruction-only skill with no install spec and no code files. No packages, downloads, or external installers are requested — lowest install risk.
Credentials
The skill declares no environment variables, no credentials, and no config paths. That is proportional: a local note-capture workflow does not require external secrets. There are no requests for unrelated credentials or high-privilege tokens.
Persistence & Privilege
always is false and the skill does not request persistent system-wide privileges or modify other skills. It will write and delete files in the user's home directory (its intended workspace), which is expected for this functionality. Note: agent autonomous invocation is enabled by default — if the agent is allowed to run autonomously, it could perform those file operations without additional user action.
Assessment
This skill appears internally consistent with its goal, but it will create and modify files under ~/kb/ and perform outbound fetches for links. Before installing, consider: (1) whether you want the skill to write/delete files automatically — if not, require confirmation before processing inbox items; (2) backing up any existing ~/kb/ or using a custom workspace path to avoid accidental overwrite; (3) whether you want external content (webpages) stored locally — consider limiting or sanitizing fetched content; (4) if the agent can run autonomously in your environment, be aware it may perform these filesystem and network actions without explicit prompts. If you need more assurance, ask the skill author how it handles confirmations, what it stores from fetched pages, and whether it supports changing the default workspace path.Like a lobster shell, security has layers — review code before you run it.
latestvk970temgpfr27t2nyhsc6hwvjs80xgcc
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🧠 Clawdis
OSLinux · macOS · Windows