Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Power User Pack
v1.0.0Bundle for power OpenClaw users: memory-stack-core, session-wrap-up-premium, agent-harness-doctor, and git-workflows-advanced. Save 27% vs buying individually.
⭐ 0· 31·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims to be a bundle of four premium skills and its SKILL.md lists those skills and a single install command; that matches the stated purpose. However, there is no source or homepage and the registry owner is opaque, which reduces traceability.
Instruction Scope
Runtime instructions are short and limited to a single install command ('clawhub install power-user-pack') and marketing text; they do not request files, environment variables, or other system data. However the SKILL.md invokes an external CLI ('clawhub') even though the skill's metadata did not declare any required binaries.
Install Mechanism
This skill is instruction-only with no install spec or code files, so it does not write code to disk by itself. The only install path is through the external 'clawhub' command referenced in the instructions.
Credentials
No environment variables, credentials, or config paths are requested; nothing disproportionate is declared.
Persistence & Privilege
Default privileges (not always-on, agent-invocable allowed) are used. The skill does not request elevated or persistent system presence.
What to consider before installing
This appears to be a simple marketing/packaging skill, but take these precautions before installing or paying: 1) Verify the bundle and the 'power-user-pack' entry exist in the official OpenClaw/ClawHub registry or marketplace and confirm the publisher identity; absence of a homepage/source makes this harder to audit. 2) Confirm that the 'clawhub' CLI referenced in SKILL.md is the legitimate installer you expect — the skill did not declare required binaries. 3) Check each included skill's metadata (owner, versions, permissions) so you know what you’ll actually get and whether you already own any of them. 4) Verify the refund policy and that pricing/updates claims are accurate. If you cannot confirm the publisher or the install mechanism, treat this as higher risk and avoid installing or purchasing until you can validate the source.Like a lobster shell, security has layers — review code before you run it.
automationvk974zbwaapqwkjyajby1yac541841q9ybundlevk974zbwaapqwkjyajby1yac541841q9ygitvk974zbwaapqwkjyajby1yac541841q9ylatestvk974zbwaapqwkjyajby1yac541841q9ymemoryvk974zbwaapqwkjyajby1yac541841q9ypower-uservk974zbwaapqwkjyajby1yac541841q9y
License
MIT-0
Free to use, modify, and redistribute. No attribution required.