ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

README Craft

v1.0.0

README 写作与优化。从零创建、审计已有、或重写 README。 蒸馏自 OMC/ECC 实战 README + awesome-readme/Standard README/Art of README 社区标准 + ClawHub 10+ README skills。 当需要为项目写 README、审计 R...

⭐ 0· 49·0 current·0 all-time
by_silhouette@lanyasheng
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name and description match the manifest and included files: the skill audits, creates, and rewrites README files and references repo metadata (package.json, pyproject.toml, etc.). It requests no environment variables, no installs, and no config paths, which is appropriate for a documentation-focused skill.
ℹ
Instruction Scope
SKILL.md instructs the agent to read README and project metadata, run a 22-item audit, and generate or rewrite README.md—these actions are within scope. However the allowed-tools list (Bash, WebFetch, Agent, Read/Write/Edit, Grep, Glob) gives the agent broad capabilities (network fetches and shell execution). The skill text references optional actions like generating GIF demos (vhs/asciinema) and verifying artifacts, which could require network access or installing tools; these are plausible for the stated purpose but grant the agent additional discretion. The instructions do not explicitly tell the agent to execute project code or exfiltrate data.
✓
Install Mechanism
There is no install spec and no code files to execute; this instruction-only skill does not download or install third-party packages by default, reducing risk.
✓
Credentials
The skill declares no required environment variables, no primary credential, and no config paths. Nothing requests unrelated credentials or elevated access beyond reading repository files.
✓
Persistence & Privilege
always is false and the skill is user-invocable. It does not request permanent presence or attempt to modify other skills or system-wide settings. The skill will write README.md in create/rewrite modes but that behavior is consistent with its purpose.
Assessment
This skill appears coherent for README auditing and generation. Before running it, consider: 1) Allow it to write only after you review diffs (use --mode audit or --score-only first). 2) If you don't want automated network access or shell commands, restrict or review uses of WebFetch/Bash/Agent in your agent policy—GIF generation or external badge fetching may trigger installs or network calls. 3) Because the skill may read repository files (package.json, pyproject.toml, source files), run it on trusted repos or a copy if you are concerned about sensitive information in the repository. No credentials are requested, which reduces risk.

Like a lobster shell, security has layers — review code before you run it.

latestvk973svee3k1qckzhxwephfvans84an0z

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments