Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Plant Doctor
v1.0.3Expert plant ID, disease diagnosis, personalized care advice, watering schedules, toxicity alerts, and propagation guidance—all with a warm, friendly tone.
⭐ 0· 71·0 current·0 all-time
by@nollio
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (plant ID, diagnosis, care schedules, toxicity alerts) align with the SKILL.md and included care templates. Required permissions, files, and actions (creating plants/ directory, updating plants/collection.json and plants/care-schedule.md) are proportionate to the stated purpose. The optional Dashboard Kit and cross-sells are consistent with a companion UX, but they introduce additional capabilities not required for basic skill operation.
Instruction Scope
Runtime instructions are concrete and limited to image analysis, plant ID/diagnosis, and updating local plant files. However the skill explicitly instructs integration with 'Supercharged Memory' (or standard OpenClaw memory) and to proactively recalculate all schedules and notify the user when seasons change. Those behaviors can cause data to be stored in or sent to an external memory service and imply proactive or background actions (notifications) not fully specified. The SKILL.md also tells the agent to use an 'image' tool or native vision capability — image analysis may be handled by a remote model provider in some setups, which would send user images off-device. These privacy-relevant behaviors are within-scope for plant care but expand the skill's reach beyond local-only processing.
Install Mechanism
No install spec or code is included; this is instruction-only. That is lower risk because nothing is downloaded or executed. Setup guidance only creates local files/directories and sets permissions.
Credentials
The skill declares no required environment variables or credentials, which fits a local-first tool. However the dashboard companion explicitly requires external DB credentials (Supabase) and the skill encourages integration with Supercharged Memory — both of which, if enabled, require environment/configuration that can expose data externally. The README/SECURITY claims 'never phones home' conflicts with these optional integrations that may send images or data to third-party services; that inconsistency is the main proportionality concern.
Persistence & Privilege
always:false and no system-wide config modification are appropriate. The skill does request write access to its own workspace files (plants/collection.json, plants/care-schedule.md) and instructs permission changes; this is expected. Be aware that autonomous invocation (the platform default) combined with memory integration could cause the skill to store or sync data without explicit per-action approval.
What to consider before installing
This skill appears to do what it says (plant ID, diagnosis, care schedules) and it uses only local files by default. Before installing, consider the following:
- Privacy: If you enable 'Supercharged Memory' or any external memory/backup, your plant data and possibly photos may be stored off-device. If you want strictly local-only behavior, do NOT enable external memory or index your plants in cloud memory.
- Vision/tool handling: Image analysis may be performed by whatever vision capability your agent uses. If that is a hosted model or tool, your photos may be sent to that provider. Confirm your model/vision provider's privacy policy if you care about where images go.
- Dashboard option: The Dashboard Companion explicitly requires a Supabase database and environment variables. Only set up the dashboard if you understand and control the database configuration (use RLS, private buckets, and env vars rather than hardcoding keys).
- Verify audit claims: README/SECURITY assert an audit and 'never phones home' — those claims conflict with the optional memory/dashboard paths. Ask the publisher for the audit report or details if that matters to you.
- Files & permissions: The setup will create plants/ and files and set restrictive permissions (chmod 700/600). That is reasonable for local storage; ensure your workspace is private and you are comfortable with the skill writing to it.
If you accept these caveats (especially around memory and vision provider handling), the skill is usable. If you require strong local-only guarantees, disable any cloud memory, avoid enabling the dashboard, and confirm which vision backend will process your images.Like a lobster shell, security has layers — review code before you run it.
latestvk977qtb326yy2m4g99czs1fqad83yetb
License
MIT-0
Free to use, modify, and redistribute. No attribution required.