Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
CareMax Indicators
v1.0.0Query and track health indicators from CareMax Health API. Use when a user asks about health metrics, lab results, trends, or wants to quickly log everyday v...
⭐ 0· 54·0 current·0 all-time
byQitao Yang@kittenyang
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill says it will query and log CareMax health indicators and its runtime instructions only reference CareMax API endpoints and helper scripts (../caremax-auth/scripts/*). Requiring an auth helper alongside an indicators skill is coherent for this purpose.
Instruction Scope
The SKILL.md instructs the agent to execute local bash scripts (api-call.sh, list-system-presets.sh, quick-log.sh, auth-flow.sh) to perform API calls and to run an OAuth browser-based auth flow when needed. This is expected for an authenticated health-API integration but means the agent will execute local scripts that can run arbitrary commands and will transmit personal health data to the CareMax service. The instructions do not ask the agent to read unrelated system files or environment variables.
Install Mechanism
Instruction-only skill with no install spec and no code files in this package. No third-party downloads or archive extraction are requested, which is low-risk from an install perspective.
Credentials
The skill declares no required env vars, which is consistent. However it depends on a sibling caremax-auth component that will hold OAuth tokens/credentials and perform the auth flow; those tokens grant access to user health data. This is proportionate to the stated functionality, but you should review the sibling auth scripts to confirm how credentials are stored and used.
Persistence & Privilege
No always:true, no install, and no instructions to modify other skills or system-wide settings. The skill does request executing local scripts in a sibling directory but does not demand permanent agent-level privileges.
Scan Findings in Context
[no_findings] expected: The package is instruction-only and contains no code files for the static scanner to analyze. The lack of findings is expected for an instructions-only skill; security-relevant behavior is in the runtime scripts referenced (../caremax-auth/scripts/*), which were not present for analysis.
Assessment
This skill is coherent for accessing and logging CareMax health indicators, but it relies on a sibling component (caremax-auth) that performs authentication and contains the scripts the skill runs. Before installing/using: (1) verify the origin and contents of the ../caremax-auth scripts (or the npx package referenced) — review what network endpoints they contact and how they store tokens; (2) confirm you trust the code that will be executed locally, since the agent will run bash scripts; (3) be aware that using the skill will transmit sensitive personal health data to the CareMax API once authenticated; and (4) consider testing with a non-production account or inspecting the auth token storage location to ensure credentials are handled as you expect.Like a lobster shell, security has layers — review code before you run it.
latestvk9700w2e9y56j8k48vta4azd7h83tavg
License
MIT-0
Free to use, modify, and redistribute. No attribution required.