Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
TOSR Test Skill
v0.1.0A test skill for validating skill creation, version update, and deletion workflows via the TOSR clawhub REST API.
⭐ 0· 46·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md states the skill will validate POST/DELETE to /api/v1/skills and exercise the skill lifecycle. However, it does not declare the API host, authentication method, or any required credentials. This may be acceptable if the platform supplies authenticated access to the clawhub API, but from the artifact alone the capability-to-requirement mapping is incomplete.
Instruction Scope
The instructions are high-level and limited to describing the intended tests (create/update/delete using timestamped slugs). They do not instruct the agent to read unrelated files or environment variables. However the doc is vague about exact API endpoints/hosts, error handling, or cleanup triggers and leaves broad discretion to the runner to perform destructive actions (publishing and deleting skills).
Install Mechanism
This is an instruction-only skill with no install spec and no code files, so nothing is written to disk and there is no installer risk.
Credentials
No environment variables or credentials are declared despite the skill's need to call the clawhub REST API to create/update/delete skills. Managing skill lifecycle typically requires authentication; the absence of declared auth is a mismatch. It may rely on platform-managed credentials, but that dependency is not documented here.
Persistence & Privilege
The skill is not marked always:true and does not request persistent presence or modify other skills' configs. Its intended actions are transient test operations (create/update/delete).
What to consider before installing
This skill is a short test helper that will create, publish a new version of, and delete skills in the clawhub registry. Before installing: (1) confirm who published it and that you trust that publisher (it modifies the registry); (2) verify how the agent/platform authenticates to the clawhub API — the SKILL.md provides no host or credential info, so it may rely on platform-scoped credentials; (3) if you allow it to run, prefer running in a sandbox or test account because it performs destructive registry operations; (4) ask the publisher for a more detailed SKILL.md that documents the exact API endpoint, required permissions, and cleanup behavior so you can audit the impact. If you cannot confirm platform-scoped permissions and origin, avoid installing on production accounts.Like a lobster shell, security has layers — review code before you run it.
latestvk9700sd1fmmw5t05mde1963ewx83hjz4
License
MIT-0
Free to use, modify, and redistribute. No attribution required.