ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

AI Interview Simulator

v1.0.2

Access and interact with AI group interview simulations: browse jobs, create/join rooms, speak, advance interviews, upload resumes, and view history and eval...

⭐ 0· 1.4k·5 current·5 all-time
by@hangeaiagent
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The name/description (AI Interview Simulator) matches the SKILL.md which documents REST endpoints for browsing jobs, creating/joining rooms, speaking, advancing interviews, uploading resumes, and retrieving history/results. Nothing in the metadata or instructions asks for unrelated services, binaries, or cloud credentials.
✓
Instruction Scope
SKILL.md only instructs the agent how to call the service's HTTP API (base URL https://me.candaigo.com) using an API key returned by the register endpoint. It does not instruct the agent to read local files, environment variables, system config paths, or to send data to other endpoints. The guidance is narrowly scoped to the service's API surface.
✓
Install Mechanism
There is no install spec and no code files — this is instruction-only. That minimizes disk-installed attack surface; the skill will only cause network requests performed at runtime.
✓
Credentials
The skill declares no required environment variables, credentials, or config paths. It expects an API key obtained from its own register endpoint, which is proportional to the documented functionality. There are no requests for unrelated secrets or system-wide credentials.
✓
Persistence & Privilege
always:false and default model invocation settings are used. The skill does not request permanent system configuration changes or elevated privileges and does not attempt to modify other skills or agent-wide settings in the provided instructions.
Assessment
This skill is an instruction-only API wrapper that makes HTTP requests to me.candaigo.com and expects you to register an API key with that service. Before installing: (1) confirm you trust the domain and service owner (no homepage or publisher info is provided), (2) treat the API key like a secret — create/rotate a scoped or ephemeral key if possible and avoid using high-privilege credentials, (3) be aware the agent will make network calls that could send chat transcripts and uploaded resumes to the service, so review the service's privacy/security policies, and (4) if you need stronger assurance, ask the skill author for source code or a verified homepage and test with a disposable account/key first.

Like a lobster shell, security has layers — review code before you run it.

latestvk97d5wvxrt5ynywbtfwnd18kbs814sd2

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments