Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Claw Chat
v1.0.1Claw Chat AI messaging assistant. Use when the user wants to enhance conversations in Claw Chat, manage message threads, draft smart replies, summarize chat...
⭐ 0· 110·0 current·0 all-time
byWenbing Ji@jiwenbing
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description promise an active messaging assistant that manages threads and can auto-create follow-ups or send replies. But the skill declares no credentials, no API endpoints, and no integration mechanism — managing messages typically requires explicit access tokens or a platform integration.
Instruction Scope
SKILL.md contains operational rules (watch for trigger phrases, auto-create follow-ups after 48h, 'auto-tag' messages) that imply background monitoring and taking actions. The instructions do not specify how the agent obtains messages, where it posts replies, what permissions are required, or any safeguards/consent checks — this gives the agent broad, vague discretion and could lead to unintended automated actions.
Install Mechanism
There is no install spec and no code files (instruction-only). That reduces surface risk because nothing is written or executed by default.
Credentials
The skill requests no environment variables or credentials despite describing capabilities that normally require API keys or service tokens. This is a mismatch: either the skill relies on external platform integrations (not documented), or it assumes the agent already has access — both should be made explicit.
Persistence & Privilege
always is false and the skill is not force-installed. However, the behavior described (monitoring for triggers, creating follow-ups after timeouts) implies persistent/background capabilities. The skill does not document how persistence would be achieved, nor any scope/limits, which is a potential operational concern.
What to consider before installing
This skill reads like a behavior policy for a Claw Chat assistant but gives no implementation details or required credentials. Before installing or enabling autonomous use:
- Ask the publisher (or registry) for the integration design: how does the skill access Claw Chat messages and send replies? Where are tokens stored and which scopes are needed?
- Do not grant it the ability to send messages or act autonomously until you confirm exact endpoints and permissions. Prefer explicit user confirmation for any outbound messages.
- If this will operate on real messages, require documented OAuth/API credentials (with least privilege) or an explicit platform integration, and test in a sandbox account first.
- If you only want drafting/summarization guidance, restrict the skill to suggest replies (read-only) and disable autonomous invocation.
- Because the source/homepage are missing, treat the skill as unverified — verify author identity and review any future code/manifest updates before trusting it with sensitive chats.Like a lobster shell, security has layers — review code before you run it.
latestvk97338s6v822fry13re2t4wnsx837v7y
License
MIT-0
Free to use, modify, and redistribute. No attribution required.