Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Lurefish
v1.0.0路亚钓鱼助手 — 天气查询、渔获记录、钓点推荐、潮汐查询、路亚饵知识、渔获统计。当用户提到路亚、钓鱼、钓点、渔获、潮汐、路亚饵、拟饵、鱼饵选择等相关话题时触发此技能。
⭐ 0· 116·0 current·0 all-time
bylurefish@jeansgit
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (fishing assistant) match the included docs and scripts. The two Python scripts implement catches logging and statistics and the references contain fishing knowledge. No unrelated dependencies, credentials, or binaries are requested.
Instruction Scope
SKILL.md instructs the agent to store data under ~/lurefish and to use wttr.in or web searches for weather/tide info. Writing/reading ~/lurefish is expected for this skill. Note: using web_search or browser to find tide tables will send user query text to external search services and recommending nearby spots may involve on‑the‑fly searches; this is expected but worth awareness.
Install Mechanism
No install spec is present and the skill ships only scripts and docs. No remote downloads or package installs are performed by the skill itself.
Credentials
The skill requests no environment variables or credentials. The code uses Path.home() to create ~/lurefish and calls curl via subprocess for wttr.in; these are proportionate to a local assistant fetching weather and storing user data.
Persistence & Privilege
always:false and user-invocable:true. The skill only creates and updates its own files under ~/lurefish; it does not modify other skills or system-wide configurations.
Assessment
This skill appears to be what it says: local catch logging and stats with fishing references. Before installing, consider: (1) It will create and store JSON files in ~/lurefish (catches.json, spots.json, stats.json) — inspect and back up or set permissions if you care about privacy. (2) The log script uses curl to query wttr.in for weather (an external request) and SKILL.md suggests using web searches for tides/spot lookup — queries may be sent to external services and can reveal location text. (3) The package contains readable Python scripts in the bundle; review them (they are included) before running if you want to verify behavior. (4) Ensure you have curl and Python available if you plan to run the scripts locally. If you need higher privacy, avoid running web_search/browser steps and keep all data local.Like a lobster shell, security has layers — review code before you run it.
latestvk97cffbwgx8mx4p93s32cbvy49836hfd
License
MIT-0
Free to use, modify, and redistribute. No attribution required.