Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
complex-task-executor
v1.0.0基于“谋事、干事、总结”方法论执行复杂任务，并自动将经验教训写入短期记忆。Invoke when user asks to handle complex tasks, plan strategies, or execute multi-step operations.
⭐ 0· 88·0 current·0 all-time
byq450770953@q450770953-boop
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description (complex task planning + memory) aligns with instructions to plan, execute steps, run tests, and produce post‑task summaries. Requiring memory writes is consistent with the description, but the skill mandates use of a platform tool (manage_core_memory) that is not declared as a required capability in metadata.
Instruction Scope
SKILL.md instructs the agent to search codebases, inspect documentation, run tests, check logs, and (critically) 'must call manage_core_memory' to persist lessons. Those actions imply access to potentially sensitive repository files, logs, and runtime artifacts. The mandatory memory write is broad and opaque (no guidance about consent, redaction, or what can/cannot be stored).
Install Mechanism
Instruction-only skill with no install steps or downloaded artifacts. No install risk detected.
Credentials
No environment variables, binaries, or external credentials are requested — appropriate for the described function. However, the skill prescribes using an external platform tool (manage_core_memory) to persist data; that capability is not surfaced in the metadata and may imply access to privileged storage or APIs.
Persistence & Privilege
While always:false (not force-installed), the skill explicitly requires writing to core memory at the end of every complex task. That is a form of persistence that can exfiltrate or permanently store sensitive context. The SKILL.md does not require explicit user consent before memory writes or describe retention/redaction policies.
What to consider before installing
This skill behaves like a project methodology coach that also automatically writes lessons into the agent's core memory. Before enabling: 1) confirm your platform's manage_core_memory tool exists and understand who can read that memory and how long it's retained; 2) ensure the agent will ask your consent before storing anything sensitive (credentials, private data, or proprietary code snippets); 3) restrict the agent's file/log access if you don't want broad repository inspection; 4) consider requiring an explicit user approval step in the workflow for any memory writes; and 5) if you cannot verify memory handling or prefer no persistence, do not install or disable the automatic memory-write step.Like a lobster shell, security has layers — review code before you run it.
latestvk97bjgx5ktm70hq3nrpzxpk0r583nhkg
License
MIT-0
Free to use, modify, and redistribute. No attribution required.