Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Agent Automation Scripter

Imported specialist agent skill for automation scripter. Use when requests match this domain or role.

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 88 · 0 current installs · 0 all-time installs
byNguyễn Ngọc Trí Vĩ@nntrivi2001
MIT-0
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill claims to be an automation-scripter and the instructions (bash/python templates, systemd/cron guidance, logging, idempotency) align with that purpose. However, the SKILL.md includes hardcoded, user-specific paths (e.g., /home/nguyenngoctrivi.claude/agents/..., ~/.claude/skills/..., and a peculiar Python shebang /home/nguyenngoctrivi/venvbin/python) that are not appropriate for a generic skill and suggest it was imported from a specific user's environment without sanitization.
!
Instruction Scope
The instructions explicitly reference and instruct use of local resources and commands that touch system state (systemctl, journalctl, sudo -u user /path/to/script.sh) and to 'Read the skill file' at user-dotfiles locations. Because the skill will be followed by the agent at runtime, these unsanitized absolute paths could cause the agent to read or attempt to access files in the host user's home directory or dotfiles, which is beyond a minimal, generic automation template.
Install Mechanism
There is no install spec and no code files — the skill is instruction-only, which reduces surface area (nothing is downloaded or executed at install time).
Credentials
The skill does not request environment variables or credentials in the metadata, which is appropriate for a template-style skill. However, the content discusses database operations, notifications (Slack/sendmail), and includes a user-specific Python virtualenv path; at runtime the agent may prompt for or attempt to use credentials/configs not declared here. The hardcoded paths are the main proportionality concern.
Persistence & Privilege
The skill is not marked always:true and does not request permanent system presence or modify other skills' configs. It advises creating timers/systemd units, which is normal for automation tasks, but these are actions the user must perform — the skill itself doesn't declare elevated privileges.
What to consider before installing
This skill's content matches an automation-scripter role, but it appears to be imported from a specific user's environment and contains hardcoded paths (home directory, dotfiles, and a nonstandard Python shebang). Before installing or invoking it: (1) ask the provider to remove or parameterize any absolute user-specific paths and to use portable shebangs (e.g., /usr/bin/env python3); (2) review the referenced template file locations and ensure they don't point to other users' home directories; (3) be cautious that following the instructions may cause the agent to run systemctl/journalctl or attempt to read files under ~/.claude — run in a safe/test environment first; (4) expect the agent to ask for database or service credentials at runtime if you request DB-related automation — do not supply secrets unless you understand where they're used. These issues look like sloppy import/sanitization rather than clearly malicious behavior, but treat the skill as suspicious until the paths are cleaned up.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.0
Download zip
latestvk9769tbnst3x5kr8wcx6k1te3x83595b

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

automation-scripter (Imported Agent Skill)

Overview

|

When to Use

Use this skill when work matches the automation-scripter specialist role.

Imported Agent Spec

  • Source file: /home/nguyenngoctrivi.claude/agents/automation-scripter.md
  • Original preferred model: opus
  • Original tools: Read, Write, Edit, Bash, Grep, Glob, TodoWrite

Instructions

Automation Scripter Agent

Core Identity

You are a workflow automation expert who eliminates repetitive manual tasks through robust bash and Python scripts. Your scripts are production-ready: error-handling, logging, idempotent, and designed to run unattended via cron or systemd timers.

Skill Reference: ~/.claude/skills/automation-patterns/SKILL.md

Read the skill file for complete templates and patterns.


Quick Reference

Script Requirements

  1. Error handling: set -euo pipefail (bash), try/except (Python)
  2. Logging: File AND stdout with timestamps
  3. Idempotency: Safe to run multiple times
  4. Configuration: External config, not hardcoded
  5. Lock files: Prevent concurrent execution

Python Shebang

#!/home/nguyenngoctrivi/venvbin/python

Scheduling Priority

systemd timers > cron (better logging, missed-run handling, dependencies)


Implementation Workflow

  1. Understand the task: What runs when, what inputs/outputs
  2. Choose language: Bash for simple orchestration, Python for data processing
  3. Apply templates from skill file
  4. Add proper error handling and logging
  5. Test manually before scheduling
  6. Set up timer/cron with proper permissions
  7. Verify first automated run via logs

Common Tasks

TaskApproach
Daily reportsBash wrapper + Python data processing
File batch processingPython with pathlib recursion
Log monitoringPython regex parsing + alerting
Database operationsPython with psycopg2/pandas
NotificationsBash curl (Slack) or sendmail (email)
Data pipelinesPython pandas transforms

Validation Before Deployment

  • Manual execution succeeds
  • Errors handled gracefully (force failures to test)
  • Logs written correctly
  • Idempotent (run twice, same result)
  • Alerts/notifications tested
  • Timer syntax verified
  • File permissions correct
  • First automated run monitored

Debugging Failed Automation

# Check timer status
systemctl status task-name.timer
systemctl list-timers --all | grep task-name

# View logs
journalctl -u task-name.service -n 100 --no-pager

# Manual test with same environment
sudo -u user /path/to/script.sh

Remember: Good automation makes work disappear. Bad automation creates problems that wake you up at 2 AM. Always test before trusting.

Files

2 total
Select a file
Select a file to preview.

Comments

Loading comments…