Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Agency Agents Main

v1.0.0

The Agency - AI role switcher. Activate specialized professional roles (frontend developer, sales agent, marketing specialist, etc.) for different tasks. Use...

0· 41·1 current·1 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for keda118228-dev/agency-agents-main.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Agency Agents Main" (keda118228-dev/agency-agents-main) from ClawHub.
Skill page: https://clawhub.ai/keda118228-dev/agency-agents-main
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install agency-agents-main

ClawHub CLI

Package manager switcher

npx clawhub@latest install agency-agents-main
Security Scan
Capability signals
CryptoRequires walletCan make purchasesCan sign transactionsRequires OAuth tokenRequires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description and SKILL.md match: the skill provides many persona .md files and instructs the agent to read them and adopt personas. Declared requirements are minimal (no env vars, no binaries), which is proportionate for a role-switcher. However the bundle contains multiple shell scripts (scripts/install.sh, scripts/convert.sh, integrations/mcp-memory/setup.sh, scripts/lint-agents.sh) and ~230 files — this is more than an instruction-only skill would typically need. The presence of install/utility scripts is a mismatch with the 'instruction-only' install metadata and should be examined.
Instruction Scope
The SKILL.md instructs the agent to read persona files from a specific path (~/.agents/skills/agency-agents-main/{category}/{file}.md) and adopt that persona. That scope is narrow and consistent with the purpose. But SKILL.md references a filesystem path within the user's home that the skill did not list under required config paths; the agent will need read access to that path. The instructions do not request external endpoints or additional credentials.
!
Install Mechanism
No install specification is declared, yet the package contains executable shell scripts (install.sh, convert.sh, setup.sh). Because there is no declared install step, it's unclear whether those scripts are intended to be executed by the agent or left for manual use by an operator. Shell scripts bundled with an otherwise 'instruction-only' skill increase risk: they can contain arbitrary commands (network downloads, filesystem changes, privilege changes). The SKILL.md does not instruct executing them, but their presence is an unexplained deviation that warrants manual review before running anything from the package.
Credentials
The skill declares no environment variables, credentials, or special config paths. That aligns with its purpose as a local persona switcher. The only notable point is SKILL.md's explicit reference to a home-directory path (~/.agents/skills/agency-agents-main/) even though 'required config paths' was empty — reading files in that directory is necessary for operation, so the path should have been declared.
Persistence & Privilege
The skill does not request permanent inclusion (always: false) and does not declare elevated privileges. Autonomous invocation (disable-model-invocation: false) is the platform default; nothing in the manifest escalates privilege. The risk center is the bundled scripts (see install_mechanism): if executed they could write/modify files, but the SKILL.md itself only instructs reading persona .md files.
What to consider before installing
This package appears to be a large collection of persona markdown files and a SKILL.md that tells the agent to read persona .md files and adopt roles — that by itself is coherent and low-risk. However, the bundle also contains several shell scripts (install.sh, convert.sh, integrations/mcp-memory/setup.sh, lint-agents.sh) even though no install step is declared. Before installing or executing anything: 1) Inspect the contents of the shell scripts (look for curl/wget, git clone, tar/extract, rm -rf, sudo, chmod, ssh/scp, or commands contacting external hosts). 2) If you need to run any of the scripts, run them in a sandboxed environment (VM or container) and review network activity. 3) Confirm the skill's source and repository origin — there's no homepage listed and the source is 'unknown'; prefer packages from a known repository or author. 4) Note that the SKILL.md references a path in your home (~/.agents/skills/agency-agents-main/) — ensure the agent only reads the intended directory and that permissions limit broader filesystem access. If you cannot review the scripts yourself, treat this skill as untrusted and avoid executing any bundled shell scripts.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎭 Clawdis
latestvk971negw4qr7w50xx0sjf0b2cs85km1f
41downloads
0stars
1versions
Updated 1d ago
v1.0.0
MIT-0

🎭 The Agency - Role Switcher

Access specialized AI professional roles from the agency-agents collection.

Available Roles

Roles are organized by domain in: ~/.agents/skills/agency-agents-main/

Engineering (engineering/):

  • frontend-developer, backend-architect, senior-developer, software-architect
  • data-engineer, security-engineer, devops-automator, sre
  • mobile-app-builder, embedded-firmware-engineer, solidity-smart-contract-engineer
  • technical-writer, code-reviewer, database-optimizer, rapid-prototyper
  • ...and 15+ more

Business (sales/, marketing/, support/, finance/):

  • Sales agent, marketing specialist, support agent, financial analyst

Specialized (specialized/, strategy/, design/):

  • Various niche professional roles

Activation

When user asks to switch to a role, read the corresponding .md file and adopt that persona.

Format: ~/.agents/skills/agency-agents-main/{category}/{filename}.md

Categories:

  • engineering/ → engineering-{role}.md
  • sales/ → sales-{role}.md
  • marketing/ → marketing-{role}.md
  • finance/ → finance-{role}.md
  • support/ → support-{role}.md
  • product/ → product-{role}.md
  • design/ → design-{role}.md
  • strategy/ → strategy-{role}.md
  • specialized/ → specialized-{role}.md

Quick Reference

CategoryPath PatternExample
Engineeringengineering/engineering-{role}.mdengineering/engineering-frontend-developer.md
Salessales/sales-{role}.mdsales/sales-account-executive.md
Marketingmarketing/marketing-{role}.mdmarketing/marketing-content-strategist.md
Supportsupport/support-{role}.mdsupport/support-technical-support-specialist.md

Role Switching Protocol

  1. User requests role switch (e.g., "switch to frontend developer")
  2. Identify category and role name
  3. Read the corresponding .md file
  4. Adopt the role's personality, tone, and workflow
  5. Confirm activation to the user

Note

This skill acts as a meta-skill. The actual role content is defined in the .md files within the agency-agents directory.

Comments

Loading comments...