Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Opus 4.6 Quality Certification
v1.0.0Opus 4.6 Quality Certification program for ClawHub skills. Verify, audit, and certify skills for quality, security, and performance.
⭐ 0· 132·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description, README, and index.js all describe a certification CLI and audit tool — that's coherent. However, the declared required binaries include 'clawhub' even though the code never invokes a 'clawhub' binary; index.js only uses node and local files. That extra binary requirement is unexplained and disproportionate to the implemented functionality.
Instruction Scope
SKILL.md instructs users/agents to run '/opus-certification' commands (e.g., '/opus-certification audit ...'). The repository provides index.js and package.json but does not provide a 'bin' entry or installer to create a '/opus-certification' CLI on PATH. index.js expects invocations like 'node index.js audit ...'. This mismatch means the runtime instructions do not match the shipped code. Additionally, the audit and self-assessment functions simulate results with randomness (Math.random), which can produce misleading pass/fail outputs and is inappropriate for a real certification tool.
Install Mechanism
There is no install spec (instruction-only), and there are no remote downloads — that's low-risk. But because SKILL.md advertises a CLI name ('/opus-certification') and required binaries, yet package.json has no 'bin' field and no install steps, the install story is incomplete/incoherent: the skill as packaged won't create the named CLI or satisfy the declared binary requirement automatically.
Credentials
The skill does not request environment variables, credentials, or config paths. The code does not perform network calls or attempt to read arbitrary secrets. No disproportionate credential access is requested.
Persistence & Privilege
The skill does not request permanent presence, does not set always:true, and contains no code to modify other skills or global agent config. Default autonomous invocation is allowed (platform default) but not combined with other high-risk behaviors here.
What to consider before installing
Key issues to consider before installing or trusting this skill:
- Mismatched CLI: SKILL.md and docs show a '/opus-certification' CLI, but package.json and the files do not install such a binary (no 'bin' field). Confirm how the CLI is supposed to be installed and whether the skill will actually provide the described commands.
- Unexplained 'clawhub' requirement: The metadata lists 'clawhub' as a required binary, but index.js never calls it. Ask the author why this is required; do not grant extra system access for it until clarified.
- Simulated/random audit results: The audit and self-assessment functions use randomization to simulate pass/fail outcomes. This makes the tool unreliable for real certification decisions and could produce misleading outputs. Do not treat its outputs as authoritative without swapping out the simulation for deterministic checks.
- Identity and source: The package lists 'ClawHub' as author and a ClawHub email/URLs are referenced, but the registry metadata shows an unknown owner ID and no homepage. Verify the publisher/maintainer identity (official ClawHub source) before trusting badges, contacting emails, or relying on the tool for formal certification.
- Safe testing steps: Run the code in a sandbox or isolated environment first, inspect index.js (already done) and confirm no network exfiltration. If you want a proper CLI, ask the maintainer to add a 'bin' entry and provide an install script or publish on a trusted registry.
What would change this assessment: a clear install spec that creates the advertised '/opus-certification' binary (or updated SKILL.md aligned with 'node index.js'), removal/justification of the 'clawhub' binary requirement, deterministic/real audit checks (not simulated randomness), and verifiable author/publisher metadata (official ClawHub account or homepage).Like a lobster shell, security has layers — review code before you run it.
latestvk975b1d88g325a7dwshjg01a4s837bs6
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binsclawhub, node