Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

property-value

v1.0.0

Estimate property values

0· 105·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for jpengcheng523-netizen/jpeng-property-value.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "property-value" (jpengcheng523-netizen/jpeng-property-value) from ClawHub.
Skill page: https://clawhub.ai/jpengcheng523-netizen/jpeng-property-value
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install jpeng-property-value

ClawHub CLI

Package manager switcher

npx clawhub@latest install jpeng-property-value
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The name and description (property value estimation) match the SKILL.md intent, but the runtime instructions reference a Python script (scripts/property_value.py) and an API key that are not present in the package or declared in the registry metadata. Requesting an API key could be appropriate for the described purpose, but the absence of the script and missing metadata is an incoherence.
!
Instruction Scope
SKILL.md tells the agent to run 'python3 scripts/property_value.py --input ...' and to set PROPERTY_API_KEY. There are no code files, no scripts/ directory, and no further guidance about what the script does or what external services the API key is for. The instructions are incomplete and vague, which gives the agent broad, undefined discretion and may lead to failed or unexpected behavior.
Install Mechanism
There is no install spec (instruction-only), which is low risk. However, the usage implies a Python script and likely dependencies; the absence of an install or dependency list means the package is incomplete and cannot run as documented.
!
Credentials
The SKILL.md asks users to set PROPERTY_API_KEY but the registry metadata lists no required environment variables or primary credential. A single API key could be reasonable for this skill's purpose, but the mismatch between documentation and declared requirements is a red flag — the skill appears to request credentials without declaring them formally.
Persistence & Privilege
The skill does not request persistent presence (always: false) and has no install-time actions or config paths. There is no evidence it modifies other skills or system settings.
What to consider before installing
Do not provide API keys or install this skill as-is. The package is missing the referenced scripts and provides no install/dependency information. Ask the publisher for: (1) the source repository or homepage, (2) the scripts/property_value.py file and any dependencies, and (3) documentation about what PROPERTY_API_KEY is for and which external API it accesses. If you must test it, do so in an isolated environment (VM or sandbox) with a throwaway API key. Prefer skills that include code or a clear install spec and a verifiable source URL before trusting credentials.

Like a lobster shell, security has layers — review code before you run it.

latestvk97c6yza36y1z3gf9g9r98ha0n83kqk7
105downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

Property Value Estimator

Estimate property values

When to Use

  • User needs valuation related functionality
  • Automating property tasks
  • Realestate operations

Usage

python3 scripts/property_value.py --input <input> --output <output>

Configuration

Set required environment variables:

export PROPERTY_API_KEY="your-api-key"

Output

Returns JSON with results:

{
  "success": true,
  "data": {}
}

Comments

Loading comments...