Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Client Manager
v1.2.0Automated client communication management — auto-triage requests by urgency, draft responses, schedule follow-ups, and track client interactions. Built for f...
⭐ 0· 69·0 current·0 all-time
bynograve.dev@nogravedev
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The skill claims cross-channel monitoring, triage, drafting, and scheduling for email/Slack/Discord/WhatsApp, but the package requires no binaries, no env vars, no config paths and includes no connector code — these capabilities would legitimately require API tokens, OAuth flows, or installable connectors. The requested footprint is disproportionate to the stated purpose.
Instruction Scope
The SKILL.md is high-level/marketing-oriented and does not provide concrete runtime instructions (no commands, no API endpoints, no environment variables to store credentials). It implicitly expects the agent to 'monitor client channels' but gives no safe, scoped instructions for how to connect, what to read, or what external endpoints to contact.
Install Mechanism
There is no install spec and no code files, which minimizes disk-write/execution risk. However, absence of an install mechanism is what creates the capability mismatch (the skill cannot implement integrations without additional components).
Credentials
No environment variables or primary credentials are declared despite the need for service credentials in order to access email, Slack, Discord, or WhatsApp. That omission is inconsistent: legitimate multi-channel integration would require explicit credential/config declarations and secure handling instructions.
Persistence & Privilege
The skill does not request always:true and is user-invocable only. It does not declare any persistent system-wide changes or privileges. Autonomy (model invocation) is allowed by default but not, by itself, a new concern here.
What to consider before installing
This package looks like a product description, not an executable skill. Before installing or trusting it: (1) ask the publisher for the actual runtime files or a concrete SKILL.md that shows how it connects to each channel (what API endpoints, what env vars/OAuth flows, where data is stored); (2) require explicit lists of required credentials and a privacy/data-retention policy — do not hand over email/Slack/WhatsApp tokens to an unknown skill without review; (3) prefer skills that declare required env vars and provide install steps (or official marketplace connectors) so you can audit them; (4) verify the vendor (clawkits.gumroad.com / clawkits.xyz) and request a demo or source code; and (5) if you see any step that asks the agent to scan unrelated files or environment variables, treat that as a red flag. Providing those missing details (runtime instructions, connector code, or declared credentials) would materially change this assessment.Like a lobster shell, security has layers — review code before you run it.
latestvk972krrtpy5d1n26hb5jce3t0h83vxv6
License
MIT-0
Free to use, modify, and redistribute. No attribution required.