Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

test-fixture-generator

v1.0.0

Automatically generate pytest fixtures for databases, API mocks, and file handling with setup and teardown support.

0· 14·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The generator produces pytest fixtures for DB, API mocks, file handling and random data as advertised. However templates include third-party imports (mysql.connector, psycopg2, requests_mock, httpx, boto3/moto, etc.) while README claims 'zero dependencies' — that is inconsistent and misleading. Templates also embed example DB credentials (localhost/test_user/test_password), which are harmless as defaults but should not be treated as real secrets.
!
Instruction Scope
SKILL.md and README instruct using `python -m test_fixture_generator ...`. The package files provided do not include a __main__.py and cli.py uses absolute imports (`from generator import ...`) instead of package-relative imports (`from .generator import ...`), so running the CLI exactly as documented may fail depending on how the package is installed. The SKILL.md does not direct the agent to read unrelated files or secrets.
Install Mechanism
There is no install spec (instruction-only), which minimizes installation risks. However the skill bundle contains runnable Python code (cli.py, generator.py, tests) — so although nothing is downloaded at install time, the included code will be written to disk when the skill package is installed or inspected. No external download URLs or archive extracts are used.
Credentials
The skill does not request environment variables or credentials. That is proportionate. Caveat: generated templates reference external services/libraries and include example credentials for local DB connections; those are not requested from the environment but could confuse users into using hardcoded values.
Persistence & Privilege
The skill does not request permanent/always-on privileges (always: false) and does not declare modifications to other skills or system-wide settings. Allowing autonomous invocation is the platform default and unremarkable here.
What to consider before installing
This package appears to implement what it claims (a pytest fixture generator) but there are a few red flags to check before installing or running it: - Dependency mismatch: README claims 'zero dependencies' but generated templates import many third‑party libraries (mysql.connector, psycopg2, requests_mock, httpx, boto3/moto, etc.). Expect to install those libraries if you use the generated fixtures. - Packaging/CLI mismatch: SKILL.md instructs running `python -m test_fixture_generator ...`, but there is no __main__.py and cli.py uses absolute imports. Try running the CLI via `python cli.py` from the package root or add a proper entry point/__main__.py; verify the package installs a console_script entrypoint if you expect `test_fixture_generator` to be runnable. - Hardcoded example creds: DB templates include example credentials (localhost/test_user/test_password). Treat these as examples only; do not use them in production and do not assume they reflect your real environment. - Inspect boto3/AWS templates: part of generator.py was truncated in the review; open and read the boto3/moto template to confirm it only sets up mocks and does not attempt credential discovery or make external AWS calls. - Run in isolation: run the code and tests in a sandboxed or virtualenv environment so missing/incorrect imports or unexpected behavior won't affect your system. If you plan to use this skill, ask the author to: correct the README dependency claims, add a proper __main__.py or console entrypoint and package-relative imports, and remove or clearly label any hardcoded credentials. If those fixes are not possible, treat the package as a local development helper rather than a drop-in CLI tool.

Like a lobster shell, security has layers — review code before you run it.

latestvk97asmsr3w59ze9dszj66v94ss84cp75

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments