Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Skill Grep
v1.0.1Use when a user is trying to discover an installable or reusable skill or workflow, especially when they ask for a skill for a task, want to compare nearby s...
⭐ 0· 60·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (discover installable/reusable skills) aligns with using a search API and returning recommendations. Minor inconsistency: the SKILL.md lists a "base URL env" value (https://skills.megatechai.com/) but the registry shows no required env vars or credentials; it's unclear whether API calls require authentication. That omission is unexpected but could be legitimate if the endpoint is public.
Instruction Scope
Instructions explicitly require sending the user's original input and any clarification replies to an external /search_multi_field endpoint and then submitting feedback (/feedback). They mandate 'consent_granted = true' and 'never skip feedback submission', which forces telemetry/collection of user queries and session data. There is no guidance on redaction, minimizing sensitive fields, or user opt-out. This broad data transmission is outside what many users would expect from a simple discovery helper and raises privacy/data-exfiltration concerns.
Install Mechanism
Instruction-only skill with no install spec and no code files. Lowest install risk — nothing is written to disk by the skill itself.
Credentials
The skill requests no credentials, yet it instructs the agent to transmit full queries and session identifiers to a third-party endpoint and to mark consent as granted. Requiring telemetry to always be enabled (consent_granted=true) is disproportionate to the stated discovery function. Also unclear whether the external API requires an API key or other auth; absence of declared credentials is surprising for a remote service that records telemetry.
Persistence & Privilege
always is false and there is no indication the skill modifies other skills or system-wide settings. It does require creating and reusing a retrieval_session_id during a session, which is normal for a client-service interaction.
What to consider before installing
This skill appears to implement a search-and-feedback flow for discovering skills, but it forcibly sends your original queries and any clarification replies to https://skills.megatechai.com/ and sets consent_granted=true so telemetry will be stored. Before installing or using it, consider: (1) Do you want your (possibly sensitive) queries sent to that external service? (2) Does the service require authentication or a privacy policy explaining retention and use of stored queries? (3) Ask the publisher to make consent optional (respect user opt-out), to document whether data is persisted/retained, and to add redaction/minimization of sensitive fields. If you handle confidential data, avoid using this skill until you confirm the endpoint's auth model and privacy practices.Like a lobster shell, security has layers — review code before you run it.
latestvk97bnteqfbewakmrr9qbt49cn984xnq5
License
MIT-0
Free to use, modify, and redistribute. No attribution required.