ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Turnip Prophet

v1.2.4

Predict Animal Crossing New Horizons turnip prices using the game's exact algorithm. Use when a user asks about turnip prices, ACNH turnips, stalk market, tu...

⭐ 0· 522·0 current·0 all-time
byNicholas Jackson@nicholasjackson
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (predicting ACNH turnip prices) aligns with the included Python predictor, chart generator, and test scripts. Required binaries (python3, jq) are justified by the scripts and cron handler.
✓
Instruction Scope
Runtime instructions are scoped to reading/updating local memory files (memory/turnip-week.json and memory/turnip-config.json), running the predictor, generating charts, and optionally setting up cron reminders. The SKILL.md documents all file reads/writes and the explicit update of the weekly data file before prediction.
ℹ
Install Mechanism
No arbitrary downloads; install steps shown in SKILL.md use pip3 (matplotlib) and package managers (apt/brew) to install jq — these are standard and low risk. Minor inconsistency: registry metadata indicated 'no install spec' while the SKILL.md contains an 'install' block with shell commands; this is a documentation/packaging mismatch but not an execution risk by itself.
✓
Credentials
The skill requests no environment variables or external credentials. The only sensitive access is optional: if you enable cron reminders, the cron jobs will invoke your local openclaw CLI and thereby act with whatever messaging credentials your OpenClaw instance already has. That behavior is documented and gated behind an explicit setup/consent flow.
ℹ
Persistence & Privilege
The skill does not request 'always' inclusion. It can write a local config (memory/turnip-config.json) and optionally install cron entries — both are limited to the skill's directory and the user's crontab. Cron reminders will run as the user and use the user's OpenClaw identity; enabling reminders is explicit in the setup flow. Review generated cron entries before accepting.
Assessment
This skill appears to do exactly what it says: predict ACNH turnip prices and optionally add scheduled reminders. Before installing/using: 1) Review scripts (scripts/cron_handler.sh, turnip_predict.py) yourself — they operate only on local files and call your openclaw CLI. 2) If offered, only enable cron reminders if you are comfortable the skill will send messages using your existing OpenClaw credentials; the setup flow promises to show the exact cron lines before adding them. 3) The SKILL.md will run pip3 install matplotlib (and may call sudo apt-get / brew to install jq); be prepared for those package installs. 4) If you change your mind, remove memory/turnip-config.json from the skill directory and remove the cron lines from your crontab. The only minor oddity: the registry metadata claims 'no install spec' even though the SKILL.md contains install commands — this is a packaging/documentation mismatch but not a functional red flag.

Like a lobster shell, security has layers — review code before you run it.

latestvk97cqa4g95da7xk14txqjkb5z181qxsr

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

Binspython3, jq

Comments