my-work-start-helper

• Analyzed: May 11, 2026, 6:19 AM
• Findings: 0
• Version: 1.0.0
• Hash: 735962df49268ee8d8bada26edac873cccdb3a470c462cda2bc7f747b99dce8c
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: my-work-start-helper Version: 1.0.0 The skill bundle 'work-start-helper' automates a standard Git synchronization workflow (stash, pull rebase, pop) and provides educational development tips from 'references/dev_tips.md'. It also includes a legitimate use of a web search tool to fetch market data. All actions are consistent with the documented purpose, and no malicious patterns or data exfiltration attempts were found.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI02: Tool Misuse and Exploitation

Note

What this means

If run in the wrong folder or at the wrong time, it could change the working tree, rebase local commits, or leave the repository with conflicts that need manual repair.

Why it was flagged

The skill instructs the agent to run Git commands that modify the current repository state. This is disclosed and matches the stated purpose, but it can affect local work or produce conflicts.

Skill content

stash → pull --rebase → stash pop ... git stash push ... git pull --rebase ... git stash pop

Recommendation

Only invoke this skill in the intended Git project, review the repository status first, and be prepared to resolve rebase or stash-pop conflicts manually.