ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Sovereign project-setup-wizard

v1.0.0

Generates production-ready project scaffolds for Node.js, Python, Go, or Rust with directory, .gitignore, README, CI/CD, Docker, linting, testing, and licens...

⭐ 0· 492·1 current·1 all-time
by@ryudi84
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name, description, SKILL.md, skill.json, and the included scripts align: a bash-based scaffolding tool that generates project files. Required tools (bash, git) in skill.json match the script behavior. Minor metadata mismatch: SKILL.md examples use the shorter slug 'project-setup-wizard' while the registry lists 'sovereign-project-setup-wizard', and skill.json includes a homepage URL although registry metadata showed none — these are metadata inconsistencies but not security issues.
✓
Instruction Scope
SKILL.md instructs the agent to run the bundled script or use openclaw run/install and documents environment variables (PSW_*). The script prompts for project details, reads local git config for defaults, and writes files into the target directory. There are no instructions to read unrelated system files, call external endpoints, or exfiltrate data in the provided content.
✓
Install Mechanism
No install spec is provided (instruction-only with an included script), so nothing is downloaded during install. The code is bundled in the skill (scripts/setup.sh) and will run locally; that is expected for a scaffolding tool and is lower risk than arbitrary network downloads.
✓
Credentials
The skill does not declare or require secrets or external service credentials. SKILL.md documents optional PSW_* environment variables to pre-populate options (language, author, etc.), which is reasonable. The script reads git config for author defaults — normal and local-only.
✓
Persistence & Privilege
always is false and the skill does not request system-wide persistence. It will create files/directories in the user-specified output directory and may initialize a git repository (configurable via flags). Autonomous invocation is allowed by default on the platform, which is normal; combined with no other red flags this is not concerning.
Assessment
This skill appears to be what it says: a local project scaffolder implemented as a bash script. Before installing/running it: (1) run it in dry-run mode (--dry-run) and inspect the generated content; (2) review the scripts/setup.sh file for any commands that would run package managers (npm/pip/go/cargo) or initialize remotes/perform network access; (3) if you want extra safety, run the script in an isolated directory or container; (4) be aware the tool may initialize a git repo by default — use --no-git-init if you prefer to avoid that; (5) verify the repository/homepage links (skill.json points to a GitHub repo and a ClawHub URL) if you need additional provenance. If you see unexpected network calls, credential prompts, or modifications outside the output directory, do not run it.

Like a lobster shell, security has layers — review code before you run it.

automationvk977s2z7hay6ammw27afhnjved81mphkdevelopervk977s2z7hay6ammw27afhnjved81mphklatestvk977s2z7hay6ammw27afhnjved81mphkproductivityvk977s2z7hay6ammw27afhnjved81mphk

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments