Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Add Pi Events D1
v1.0.0Add or update PI events in the Cloudflare D1 mb-events database using parsed details, ISO 8601 dates, and SQL insert commands executed remotely.
⭐ 0· 6·1 current·1 all-time
byAlexander Babenchuk@ababen
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's stated purpose—adding events to a Cloudflare D1 database—legitimately needs a Cloudflare API token and account ID and a way to run wrangler. However the registry shows no required env vars or binaries while SKILL.md tells the agent to source ~/.env/.env and run 'npx wrangler' and 'curl' from a specific repo path (/Users/viki/...). The lack of declared requirements (env, binaries) is an incoherence.
Instruction Scope
SKILL.md explicitly instructs sourcing a local secrets file (~/.env/.env), changing into a specific user repo path, building SQL from user-provided text, and executing SQL remotely. Sourcing a general .env file can expose unrelated secrets; the hard-coded local path suggests this SKILL.md was written for a particular developer environment and may not safely generalize. The SQL construction rules are manual (doubling single quotes) and grant the agent broad discretion to construct and execute arbitrary SQL statements against the live DB.
Install Mechanism
This is instruction-only (no install spec), which is lower-risk than arbitrary downloads. However the instructions rely on 'npx wrangler', 'curl', and 'jq' — implying Node/npm and command-line tools are required even though the manifest lists none. That mismatch should be corrected so users know preconditions.
Credentials
The SKILL.md expects $CF_API_TOKEN and $CF_ACCOUNT_ID (and mentions CF_ZONE_BABENCHUK_COM) but the skill metadata declares no required env vars or primary credential. Requiring a Cloudflare API token and account ID is proportionate to the task, but sourcing ~/.env/.env risks exposing other secrets; the skill should instead require and document minimal, least-privilege tokens explicitly.
Persistence & Privilege
The skill is not marked always:true and does not request persistent system-wide changes in the manifest. It does not attempt to modify other skills or system configuration. Autonomous invocation is allowed by default but not combined with other high-privilege flags here.
What to consider before installing
This skill appears to do what it says (insert/update events in a Cloudflare D1 DB), but the SKILL.md contains developer-specific steps and undeclared requirements. Before installing or using it: 1) Ask the author to update the skill metadata to declare required env vars (CF_API_TOKEN, CF_ACCOUNT_ID) and required binaries (node/npm, npx, wrangler, curl, jq). 2) Do not source a monolithic ~/.env/.env from the agent — instead set only the specific variables needed, and prefer a scoped Cloudflare API token with minimal D1/DB privileges. 3) Confirm where the agent will run (the repo path /Users/viki/... is local to the author) and whether wrangler d1 execute requires project config; avoid running arbitrary SQL generated from untrusted text without review. 4) For bulk or automated inserts, back up the database or test in a staging DB and validate date parsing and SQL escaping to prevent accidental data corruption or injection. If the author cannot clarify the env/binary requirements and remove hard-coded local paths, consider this skill untrusted.Like a lobster shell, security has layers — review code before you run it.
latestvk974nbrej4nf7tqbgr83dvv6ms84hmen
License
MIT-0
Free to use, modify, and redistribute. No attribution required.