Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Openclaw Cfg Safe Edit
v1.0.0OpenClaw 配置文件修改前的验证规则。用于在修改 openclaw.json 或任何配置文件之前查询文档确认配置项可用性，避免因 OpenClaw 版本更新导致配置不兼容的问题。
⭐ 0· 127·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md describes validating OpenClaw configuration edits, which fits the skill name. However, the instructions assume the presence of a locally installed OpenClaw package and CLI (e.g., files under /home/root1/.npm-global/lib/node_modules/openclaw and the 'openclaw' gateway command) while the skill metadata declares no required binaries or environment variables. That mismatch (calling a local CLI but not declaring it) is incoherent.
Instruction Scope
Instructions tell the agent to run shell commands that list and grep a specific absolute path (/home/root1/.npm-global/...) and to invoke 'openclaw gateway config.schema.lookup'. These actions require file-system access and a specific user layout. Hard-coded paths tied to a particular user account are unexpected for a generic skill and could lead to incorrect behavior or unintended access to user files. The skill also instructs consulting online docs, which is reasonable, but the local-path reliance is problematic.
Install Mechanism
This is an instruction-only skill with no install spec and no code files, which is low-risk from an installation perspective. Nothing is downloaded or written to disk by the skill itself.
Credentials
The skill declares no required env vars or credentials, yet its instructions implicitly require access to a user's filesystem and an installed 'openclaw' CLI. The lack of declared required binaries (openclaw) and the use of an absolute home-directory path are disproportionate and ambiguous. A well-scoped skill should declare required binaries or use portable references (e.g., $HOME or a discovery step).
Persistence & Privilege
The skill is not set to always: true and does not request persistent/system-wide settings. It does not modify other skills or agent configuration according to the provided files.
What to consider before installing
This skill's goal (validate OpenClaw config changes) is reasonable, but the SKILL.md hard-codes a local path (/home/root1/...) and assumes an 'openclaw' CLI without declaring it. Before installing: 1) ask the skill author to remove hard-coded user paths and use $HOME or a discovery step; 2) require the skill metadata to declare the 'openclaw' binary (or document it); 3) confirm the agent will only access intended config files (not arbitrary home dirs); and 4) test in a safe environment. If you do not control /home/root1 or do not have the openclaw CLI installed, do not enable autonomous invocation until these issues are fixed.Like a lobster shell, security has layers — review code before you run it.
latestvk97cwq9pma1m22bd74gvte9csx837wyb
License
MIT-0
Free to use, modify, and redistribute. No attribution required.