ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Bitrix24

v1.0.0

Work with Bitrix24 (Битрикс24) via Vibe Platform API and MCP documentation server. Triggers on: CRM — "сделки", "контакты", "лиды", "воронка", "клиенты", "de...

⭐ 1· 975·4 current·4 all-time
by@rsvbitrix
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
Name/description match the included code and references: the repo contains a unified CLI (scripts/vibe.py), config management (scripts/vibe_config.py), and many domain references for Bitrix24. However metadata claims "Required config paths: none" and "Required env vars: none" while the code explicitly expects and persists an API key in ~/.config/bitrix24-skill/config.json (see scripts/vibe_config.py and docs/specs). The MCP server (https://mcp-dev.bitrix24.tech) is declared and used in metadata which is coherent with the skill purpose.
!
Instruction Scope
SKILL.md instructs the agent to 'EXECUTE IMMEDIATELY' for read requests (call scripts/vibe.py directly without confirming) and to never display technical details to the user. The runtime rules plus the CLI calls mean the agent will perform network calls automatically on user read requests. The SKILL.md and onboarding also describe asking users to provide a Vibe API key (paste it) and then saving it — the instructions therefore involve collecting and storing a secret via the chat flow. These behaviors are within the connector's purpose but expand the agent's runtime scope (reading/storing a private key and performing automatic network calls) and are not fully reflected in the declared metadata.
✓
Install Mechanism
No install spec is provided (instruction-only install), and the skill requires python3 which is reasonable for bundled Python scripts. All code is present in the repository; nothing is downloaded from arbitrary URLs during install. That is the lower-risk pattern for skills that ship code with the package.
!
Credentials
The package declares no required environment variables or config paths, but the code manages and expects a persistent API key in ~/.config/bitrix24-skill/config.json (see scripts/vibe_config.py DEFAULT_CONFIG_PATH and persist_key/load_key functions). The onboarding flow documented in CLAUDE.md/specs instructs the user to paste the API key into chat so the skill can persist it — this means a sensitive credential will transit the chat and be stored on disk. The omission of any declared primary credential or config path from metadata is an incoherence and reduces transparency about what secrets are needed and where they are stored.
ℹ
Persistence & Privilege
The skill persists configuration (api_key, cached user_id and timezone) in the user's home directory (~/.config/bitrix24-skill/config.json) which is expected for a connector. The repo also documents an "auto-update" scheduled task that checks ClawHub and auto-installs new versions (CHANGELOG.md, CLAUDE.md), which could allow code to change over time if enabled on the host. The skill does not set always:true and does not declare system-wide configuration modifications, but the auto-update mechanism and config file persistence are important to review and control.
What to consider before installing
What to check before installing: - The skill stores a Vibe API key in ~/.config/bitrix24-skill/config.json. Confirm you are comfortable with the key being stored on disk and that the hosting machine is secure. - The SKILL.md and docs describe asking users to paste the API key into the chat; avoid pasting highly privileged keys into chat logs unless you trust the environment. Prefer creating a key with minimally required scopes. - Metadata does not declare the required credential or config path even though the code uses them — treat that as a transparency gap. Ask the publisher or inspect scripts/vibe_config.py and scripts/vibe.py to verify where keys are read/written. - The skill includes an auto-update mechanism (documents scheduled auto-installs from ClawHub). If you don't want remote code to be auto-installed, ensure the auto-update task is not enabled on your host. - If you proceed, review and (if needed) limit the API key scopes in Bitrix24, and consider running the scripts in an account/environment with restricted permissions. If you need higher assurance, run the code in an isolated environment and inspect network destinations (vibecode.bitrix24.tech and mcp-dev.bitrix24.tech) before providing credentials.

Like a lobster shell, security has layers — review code before you run it.

b24vk970ah2t0kfy3v2ffxmr0vx25181k527bitrixvk970ah2t0kfy3v2ffxmr0vx25181k527bitrix24vk970ah2t0kfy3v2ffxmr0vx25181k527channelvk970ah2t0kfy3v2ffxmr0vx25181k527crmvk970ah2t0kfy3v2ffxmr0vx25181k527latestvk978yn65cdw1ebjcfg1ayseg2n83kz0sproductivityvk970ah2t0kfy3v2ffxmr0vx25181k527tasksvk970ah2t0kfy3v2ffxmr0vx25181k527

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

B24 Clawdis
Binspython3

Comments