Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Claw Quest Connect
v0.1.3Use when the user wants to connect Claw Quest Android to this OpenClaw gateway with the manual URL+token flow, send those details over WhatsApp, and optional...
⭐ 0· 36·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill requires the 'openclaw' binary and the SKILL.md only invokes openclaw commands (config get, plugins inspect, devices list/approve). Those requirements align with the described purpose of retrieving gateway URL/token/password and managing device pairing.
Instruction Scope
Instructions tell the agent to read local gateway secrets (gateway.auth.token or gateway.auth.password) and to always send them via WhatsApp if outbound WhatsApp is configured. The skill does not specify how the WhatsApp recipient is selected or require explicit user confirmation before transmitting secrets. It also permits automatically approving the next matching pairing request without an explicit final confirmation. These behaviors can lead to inadvertent secret disclosure or unintended approvals.
Install Mechanism
Instruction-only skill with no install steps or external downloads; this is low risk and consistent with the metadata.
Credentials
The skill declares no environment variables, which is consistent, but it does read sensitive local configuration values (gateway.auth.token/password) via openclaw. Reading and transmitting one auth value is proportionate to a manual-setup flow, but it is sensitive and should be explicitly consented to and targeted only to a confirmed recipient.
Persistence & Privilege
always is false and the skill is user-invocable; it does not request persistent system-wide privileges or modify other skills. Autonomous invocation is allowed (platform default) but not combined with other privilege red flags.
What to consider before installing
This skill appears to do what it says (use openclaw to fetch the gateway URL and the single auth value required for manual setup) but it will read and transmit that secret and may auto-approve a pairing. Before installing or running it: 1) Confirm who the WhatsApp recipient will be and require explicit user confirmation before sending any token/password; 2) Prefer showing the secret in chat and letting the user paste it unless they explicitly request WhatsApp handoff; 3) Require an explicit confirmation step before approving any pairing request; 4) Verify the device-pair plugin is enabled and check audit logs after pairing; 5) Consider rotating the token/password after pairing if exposure is a concern. If you need stricter controls (e.g., never send secrets to external services automatically), ask the skill author to add explicit recipient selection and a confirmation prompt in the SKILL.md.Like a lobster shell, security has layers — review code before you run it.
latestvk97cb1jdghspn839v73mr35zs984c0bp
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
OSWindows · Linux · macOS
Binsopenclaw