Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Claude Code ↔ OpenClaw Skill Sync
v1.0.0This skill should be used when the user wants to sync, synchronize, or compare skills between Claude Code and OpenClaw. Use it for requests like "sync my ski...
⭐ 1· 53·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill declares it will scan ~/.claude/skills/ and ~/.openclaw/workspace/skills/ and read/write SKILL.md files; all required actions (directory listing, reading/writing SKILL.md, creating _meta.json) are directly related to the stated purpose of syncing skills.
Instruction Scope
Instructions are narrowly scoped to listing one-level subdirectories, reading SKILL.md contents, comparing them, and copying/overwriting files with explicit user prompts. Two items to note: (1) the security rules say 'Never output token values, API keys, or credentials that may appear in skill files' — SKILL.md files may legitimately contain secrets, and the skill must read full contents to copy them, so there's a risk of accidental exposure if the agent were later instructed to transmit content elsewhere; (2) the instruction 'Always use ~ and never expand ~ to an absolute path' is unusual (it prevents the skill from resolving absolute locations) and could interfere with auditing or access-control checks — it's not necessary for the stated purpose and is worth questioning.
Install Mechanism
Instruction-only skill with no install steps or downloads. No files are written as part of an installation process beyond the operations the skill explicitly instructs at runtime.
Credentials
No environment variables, binaries, or external credentials are requested. The skill only needs filesystem access to the two specified directories, which is proportional to its stated function.
Persistence & Privilege
The skill does not request always:true and does not modify other skills' configs beyond writing SKILL.md and _meta.json into the specified Claude/OpenClaw skill directories — these writes are the expected behavior for a sync tool.
Assessment
This skill appears coherent: it will read and write SKILL.md files under ~/.claude/skills/ and ~/.openclaw/workspace/skills/ and will prompt you before copying or overwriting. Before using it: (1) ensure you trust the agent invoking the skill because SKILL.md files can contain secrets or tokens; copying those files moves any embedded secrets between tool directories; (2) consider backing up both directories before performing bulk operations; (3) ask why the SKILL.md requires the instruction to 'never expand ~' — that is atypical and may complicate auditing; (4) when prompted, review the first lines shown in conflict previews and, if a file may contain sensitive data, open and inspect the full SKILL.md yourself rather than relying solely on the skill’s copy action.Like a lobster shell, security has layers — review code before you run it.
latestvk97c0haggmzbw23h69h9yzpn5s84k15y
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
