Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
SOLO.ro cli
v1.1.0Monitor and interact with SOLO.ro accounting platform via CLI or TUI (summary, revenues, expenses, queue, e-factura, company). Use when a user asks to check their accounting data, view invoices, expenses, or e-factura documents, or translate a task into safe solo-cli commands.
⭐ 1· 1.9k·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The name/description match the runtime instructions: the SKILL.md documents commands for summary, revenues, expenses, efactura, upload, queue, and a TUI. There are no unexplained environment variables, binaries, or unrelated service credentials requested.
Instruction Scope
Instructions are focused on the solo-cli tool and its config file. However, the skill tells users to store username/password in a local JSON config and to cache session cookies (~/.config/solo-cli/config.json and cookies.json). This is coherent with the CLI's needs but is a security risk (plaintext credentials, persistent cookies) and should be handled carefully.
Install Mechanism
The skill is instruction-only (no install spec). SKILL.md suggests installing via Homebrew from a third-party tap (rursache/tap/solo-cli). That is not inherently malicious but is higher-risk than an official/first-party tap or verified release; the skill does not provide checksums or an alternative trusted source.
Credentials
The skill declares no required env vars or primary credential (consistent). In practice it instructs users to place credentials in a config file (username/password) and caches cookies—these are proportional to the CLI's purpose but increase local credential exposure. The SKILL.md does not advise using OS credential stores or alternatives like tokens.
Persistence & Privilege
No special persistence requested: always is false, there are no install artifacts in the skill bundle, and it does not claim to modify other skills or global agent settings. The described files are confined to the user's ~/.config/solo-cli path.
Assessment
This skill appears to honestly document how to use a third-party solo-cli tool, but take precautions before installing or providing credentials: 1) Verify the solo-cli binary provenance — prefer an official project page or GitHub releases and check checksums; be cautious about third-party Homebrew taps. 2) Avoid storing plaintext passwords in config.json if possible — use OS credential stores, environment-managed secrets, or an API token if the service supports it. 3) Ensure config and cookies files are created with restrictive filesystem permissions (chmod 600). 4) Test using the demo mode first and inspect network calls (or run in a sandbox) before supplying real credentials. 5) If you must use your real account, consider creating a limited/test account with minimal data. If you want a stronger assurance that this is safe, ask the publisher for a signed release URL, checksum, and source repository to review the actual executable's behavior.Like a lobster shell, security has layers — review code before you run it.
latestvk9792sj7d2b0f478st51f8akc17yz91h
License
MIT-0
Free to use, modify, and redistribute. No attribution required.