Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

skill-stats

v1.0.0

Query, analyze, and track all skill usage information. This skill should be invoked when users ask about skill usage, call counts, success rates, last used t...

1· 360·1 current·1 all-time
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description and the included code align: the scripts scan local Claude Code (~/.claude) and OpenClaw (~/.openclaw) session and skill directories to extract skill invocation records and compute usage stats. No unrelated credentials, binaries, or install steps are requested.
Instruction Scope
The SKILL.md and scripts instruct the agent to read numerous files under the user's home (~/.claude and ~/.openclaw), including session .jsonl files, settings.json, and SKILL.md files for discovered skills. This is consistent with the stated purpose, but it does mean the skill will access potentially sensitive session content and metadata (user messages, cwd, etc.). The code appears to only extract structured invocation records, but it reads whole files to parse them.
Install Mechanism
There is no packaged install spec; SKILL.md recommends running the included TypeScript using 'npx -y tsx ${SKILL_DIR}/scripts/main.ts'. That will cause npx to fetch the 'tsx' runner from npm if not present. The skill's own code is bundled in the package (no external download URLs), so runtime risk is limited to executing these local scripts and the tsx runner fetched by npx.
Credentials
The skill requests no credentials or secret environment variables. It does use process.env.HOME to locate user directories (normal). It reads user settings (enabled plugins) and skill directories to determine scope — these accesses are proportional to its function.
Persistence & Privilege
always:false and the skill does not request elevated or platform-wide privileges. It writes statistics to local files under ~/.claude/skill-stats and ~/.openclaw/skill-stats, which is appropriate for a local usage-collection tool and does not modify other skills' configurations.
Assessment
This skill is coherent with its purpose, but it reads many local session and settings files under ~/.claude and ~/.openclaw which may contain sensitive conversation content or metadata. Before running: - Review the bundled scripts (already included) to confirm behavior (they only parse and aggregate invocation records and write local JSON files). - Be aware SKILL.md suggests using 'npx -y tsx', which will fetch the 'tsx' runner from npm if you don't have it; if you prefer, install/inspect tsx locally or run the scripts with your own node/ts runner. - If you have sensitive data in session files, consider running in a limited environment or backing up/removing sensitive sessions first. - Check the files the skill will create (~/.claude/skill-stats/*, ~/.openclaw/skill-stats/*) and their permissions after execution. - If you need stronger guarantees, run the scripts in a container or on a machine/user profile dedicated to diagnostics.

Like a lobster shell, security has layers — review code before you run it.

latestvk97eet0s578mmrywvr6djmn9n982dcfd
360downloads
1stars
1versions
Updated 7h ago
v1.0.0
MIT-0

Skill Stats - Skill Usage Statistics

Analyze and track skill usage across Claude Code and OpenClaw environments.

Features

Claude Code

  • Scans all session files under ~/.claude/projects/
  • Categorizes by scope (builtin/plugin/user/project)
  • Shows usage frequency, success rate, and last used time
  • Identifies unused and deleted skills

OpenClaw

  • Scans all session files under ~/.openclaw/agents/main/sessions/
  • Categorizes by scope (openclaw-workspace/openclaw-global)
  • Parses toolCall-type skill invocation records
  • Stores statistics independently

Usage

Execute the statistics script with the required --context parameter:

Claude Code Environment:

npx -y tsx ${SKILL_DIR}/scripts/main.ts --context claude-code

OpenClaw Environment:

npx -y tsx ${SKILL_DIR}/scripts/main.ts --context openclaw

Output Examples

Claude Code

====================================================================================================
Skill Usage Statistics
====================================================================================================
Last Updated: 2026-03-05T09:26:33.759Z

【BUILTIN - Built-in】
----------------------------------------------------------------------------------------------------
  Skill Name                         Calls       Success Rate  Last Used                 Time Ago         Status
  -----------------------------------------------------------------------------------------------
  keybindings-help                   1         100.0%    2026/02/09 19:52      23 days ago      Active

【USER - User】
----------------------------------------------------------------------------------------------------
  skill-stats                        24        100.0%    2026/03/03 22:11      1 day ago        Active
  nano-banana                        10        100.0%    2026/02/24 16:58      9 days ago       Active

OpenClaw

====================================================================================================
Skill Usage Statistics
====================================================================================================
Last Updated: 2026-03-05T09:26:06.765Z

【OPENCLAW-GLOBAL - OpenClaw Global】
----------------------------------------------------------------------------------------------------
  Skill Name                         Calls       Success Rate  Last Used                 Time Ago         Status
  -----------------------------------------------------------------------------------------------
  enterprise-doc                     1         100.0%    2026/03/04 14:45      1 day ago        Active
  file-upload                        1         100.0%    2026/03/05 14:46      Today            Active

How It Works

Claude Code

  1. Scans all session files (.jsonl) under ~/.claude/projects/
  2. Extracts Skill tool invocation records
  3. Calculates call counts, success rates, and project usage for each skill
  4. Displays results categorized by scope

OpenClaw

  1. Scans session files (.jsonl) under ~/.openclaw/agents/main/sessions/
  2. Parses toolCall-type skill invocations (via read tool reading SKILL.md)
  3. Identifies workspace-level and global-level skills
  4. Stores statistics independently

Data Storage

  • Claude Code: ~/.claude/skill-stats/global-stats.json
  • OpenClaw: ~/.openclaw/skill-stats/openclaw-global-stats.json

Comments

Loading comments...