ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

KameleonDB

v0.1.5

Store and query structured data without planning schemas upfront. Use when you need to remember information, track entities across conversations, build knowledge bases, ingest API data, store user preferences, create CRM systems, or maintain any persistent state. Automatically evolves data structure as you discover new fields. No migrations, no schema design - just store data and query it.

⭐ 2· 1.6k·0 current·1 all-time
byMarcos Santos@marcosnataqs
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (agent-native DB) align with declared requirements: the skill requires the 'kameleondb' binary and KAMELEONDB_URL. Those are expected and necessary for a CLI database client.
ℹ
Instruction Scope
SKILL.md instructs the agent to run kameleondb commands (schema create/alter, data insert, query run, storage materialize). This is consistent with the stated purpose. The doc also suggests storing the KAMELEONDB_URL in agent memory files for convenience — this is a functional recommendation but increases the chance that a secret DB URL is persisted in agent memory; review how your agent stores memory before following that guidance.
✓
Install Mechanism
This is an instruction-only skill with no install spec. SKILL.md suggests installing via 'pip install kameleondb', which is a normal, low-risk package install path; nothing is downloaded from obscure URLs in the skill bundle itself.
✓
Credentials
Only KAMELEONDB_URL is required and listed as the primary credential. That is proportionate for a database client. Note: that URL can contain DB credentials (user:pass); ensure you provide a least-privilege connection string and avoid exposing production credentials to agents unless necessary.
ℹ
Persistence & Privilege
always is false (good). The skill allows the agent to autonomously run commands that modify schema and data (normal for this DB integration). Because the agent can create/alter schemas and migrate data, only install this skill for agents you trust with mutating access to the target database.
Assessment
This skill is internally consistent with its purpose, but before installing consider: (1) the skill requires a KAMELEONDB_URL which may contain DB credentials — provide a least-privilege account and avoid using production secrets, (2) the agent will be able to run commands that create/alter schemas and migrate data, so only grant it to trusted agents or test databases, (3) there's no automated install in the skill bundle — you or your environment must ensure the 'kameleondb' CLI/Python package is installed and up-to-date (review the PyPI package and GitHub repo), and (4) avoid persisting the DB URL in long-lived public/shared memories; use secure secret storage or environment config where possible.

Like a lobster shell, security has layers — review code before you run it.

latestvk974c5ysegpftcrxedrbywpynx80y2zz

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🦎 Clawdis
Binskameleondb
EnvKAMELEONDB_URL
Primary envKAMELEONDB_URL

Comments