Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Proof of Work
v1.0.0Automates verification that AI agents truly completed tasks by checking output files, system states, and logs for expected results and activity.
⭐ 0· 58·0 current·0 all-time
by@kgapol
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description (verify agent outputs, files, system state, logs) aligns with what the scripts actually do: file checks, JSON/Markdown validation, DB queries, process/port/log checks and optional AI quality checks.
Instruction Scope
SKILL.md and the scripts instruct the agent to read files, logs, databases, and system state (processes/ports). This is consistent with a verification tool, but it gives the script access to arbitrary paths and DB queries specified by the user/config — review config and inputs carefully before running.
Install Mechanism
Provided install.sh performs local file copy into ~/.proof-of-work and optionally creates a /usr/local/bin symlink (no network fetch in the bundled installer). However README recommends a curl | bash pattern to an external URL and a git clone URL placeholder — do not blindly run remote install commands from unknown hosts.
Credentials
Registry metadata lists no required binaries/env, but the script requires jq for config parsing and optionally calls an 'ollama' binary for AI checks. The inconsistency (missing required-binaries declaration) is misleading and could cause surprise when the script errors or behaves differently. The script also asks for DB paths and arbitrary queries (expected for this tool, but sensitive).
Persistence & Privilege
The installer writes to a user-owned directory (~/.proof-of-work) and may create a symlink in /usr/local/bin if writable; always:false and no global modifications to other skills or system settings are performed. This is a normal level of persistence for a user utility.
What to consider before installing
This skill appears to do what it claims, but take precautions before installing: 1) The scripts require the jq binary (and optionally 'ollama' for AI checks) even though the registry metadata didn't declare required binaries — install jq first or the tool will fail. 2) Review the bundled proof-of-work.sh and sample-config.json to see what file paths, DB queries, and logs it will read; do not point it at sensitive system DBs or directories unless you trust the code and your inputs. 3) Ignore the README's unsafe generic advice to curl|bash from external URLs — use the included install.sh or inspect any remote installer before running. 4) If you plan to enable AI checks, understand that 'ollama run' will run a local model service (ensure Ollama is local and trusted; otherwise avoid enabling AI checks). 5) If uncertain, run the tool in an isolated user account or container, and audit the log file and config before enabling cron integration.Like a lobster shell, security has layers — review code before you run it.
latestvk976mq3wypxfd1d374fhyasx2583wxdd
License
MIT-0
Free to use, modify, and redistribute. No attribution required.