Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Aba Therapy Center Video

v1.0.0

AI video creation for aba therapy centers, wealth management practices, independent financial planners, and registered investment advisors — generate retirem...

0· 50·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
CryptoCan make purchases
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill is titled 'Aba Therapy Center Video' and mentions ABA therapy centers in its metadata, but the SKILL.md content (use cases, scenarios, keywords) is dominated by financial planning, retirement, Social Security, RIAs, and advisor marketing. This mixing of unrelated domains (healthcare/therapy vs. financial services) is incoherent: a single skill should clearly target one domain. It's unclear whether the skill is meant for ABA therapy centers, financial advisors, or both, and why unrelated keywords are present.
Instruction Scope
The SKILL.md is an instruction-only document describing desired video outputs, audiences, and many use-cases. There are no concrete runtime commands, no referenced files, and no explicit steps that access system files or credentials. However the instructions are broad and marketing-oriented rather than prescriptive (they give many content ideas but do not define inputs, output formats, or limits). That vagueness grants the agent wide discretion about what to generate and how, which is a scope risk if the user expects narrow, repeatable behavior.
Install Mechanism
No install spec and no code files are present. This is an instruction-only skill, which means nothing is written to disk or pulled from external URLs during install — lowest install risk.
Credentials
The skill declares no required environment variables, no credentials, and no config paths. The requested privileges are minimal and proportionate to an instruction-only text skill. Note: if the skill were later extended to process client data, it should declare required secrets and compliance requirements (e.g., PHI handling for therapy centers).
Persistence & Privilege
The skill uses default persistence flags (not always: true) and does not request persistent system-wide modifications. Autonomous invocation is allowed by platform default but is not compounded by other high privileges here.
What to consider before installing
This skill is internally inconsistent: the name/metadata mention ABA therapy centers but the instructions and examples are almost exclusively about financial advisor marketing. Before installing, ask the author to clarify the intended audience and provide sample inputs/outputs (example video scripts, templates, or a clear runtime spec). If you plan to feed real client data, confirm how PHI/PII will be handled and whether the skill is intended to produce therapy-related content (which can have regulatory/HIPAA implications) or financial advice/marketing (which has its own compliance needs). Because the SKILL.md is long and vague, test it in a sandbox with non-sensitive dummy data to verify behavior and outputs. If you cannot get a clear explanation, treat the skill as risky for production use due to the domain confusion.

Like a lobster shell, security has layers — review code before you run it.

latestvk974b44f79wpgev04ym2q9pwkx84fd4w

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments