Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Workspace Casual Lucas
v1.0.3Offers a casual interface to list files, run commands, read files, and automate tasks in your OpenClaw workspace.
⭐ 0· 998·2 current·2 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The name/description and code align: the skill lists files, opens files, and runs commands. The use of fs and child_process.execSync is consistent with the declared commands.
Instruction Scope
Although SKILL.md describes workspace operations, the implementation accepts arbitrary paths and arbitrary shell commands (execSync(command)) and resolves arbitrary file paths. This goes beyond a constrained 'workspace-only' scope and allows reading or executing any file/command the agent process can access.
Install Mechanism
No install spec is present (instruction-only + small index.js). Nothing is downloaded or written during install, reducing supply-chain risk.
Credentials
No environment variables, credentials, or external config paths are requested; the skill does not ask for unrelated secrets.
Persistence & Privilege
always is false, but disable-model-invocation is false (default) so the agent may invoke this skill autonomously. Combined with the ability to execute arbitrary shell commands and read arbitrary files, autonomous invocation increases blast radius. Additionally, triggers.json maps patterns to these commands and lists a channel (whatsapp), which could enable remote-triggered actions if channel integration permits.
What to consider before installing
This skill legitimately implements a workspace helper, but it exposes two powerful actions: running arbitrary shell commands and reading arbitrary files. Before installing, consider: 1) Do you trust the author and host environment? 2) Restrict or remove run_command if you don't need arbitrary shell execution — replace it with a limited set of safe operations. 3) Add input validation and path sandboxing (limit to a single workspace directory). 4) Disable autonomous invocation (set disable-model-invocation = true) or require explicit user confirmation before running commands. 5) Review and, if needed, remove triggers that expose these actions to external channels (triggers.json lists "whatsapp"). 6) Run the skill in an isolated/sandboxed account or container if you must use it. If you cannot apply these mitigations, avoid installing this skill on agents with network access or elevated privileges.Like a lobster shell, security has layers — review code before you run it.
latestvk97fmaetz62jkmhk208937ed2181070k
License
MIT-0
Free to use, modify, and redistribute. No attribution required.