Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Chat Ui
v0.1.5Chat UI building blocks for React/Next.js from ui.inference.sh. Components: container, messages, input, typing indicators, avatars. Capabilities: chat interf...
⭐ 0· 1.3k·5 current·6 all-time
byÖmer Karışman@okaris
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name, description, and instructions all describe installing and using chat UI building blocks for React/Next.js. The imports and example code match the stated purpose and do not request unrelated capabilities or credentials.
Instruction Scope
SKILL.md contains only component usage examples and a single install command (npx shadcn@latest add https://ui.inference.sh/r/chat.json). The instructions do not request reading arbitrary host files, environment secrets, or other unrelated system state. Note: the runtime instructions tell the user/agent to run npx which will fetch remote template data — this is expected for a UI component recipe but is the primary external action the agent would perform.
Install Mechanism
There is no registry install spec (the skill is instruction-only). The recommended install uses npx and a URL hosted at ui.inference.sh to pull component definitions. That URL aligns with the skill's branding (inference.sh) but it means running a network download via npx; users should inspect the fetched template before executing in production. No obscure URL shorteners or IP addresses are used.
Credentials
The skill declares no required environment variables, credentials, or config paths. The SKILL.md does not reference any secrets or unrelated environment variables.
Persistence & Privilege
The skill does not request always:true or any elevated persistent presence. It is user-invocable and allows normal autonomous invocation; this is typical and consistent for a utility skill of this type.
Assessment
This skill is a coherent instruction-only recipe for adding chat UI components. It does not request credentials or access to your system beyond running npx to fetch templates from ui.inference.sh. Before running the npx command, review the downloaded template files (or run in an isolated/dev environment) to ensure they match expectations. Treat network-downloaded code like any third-party package: inspect contents, run npm/yarn audits, and prefer running these commands in a sandbox if you are unsure. If you need higher assurance, ask the publisher for a pinned release or a package published to a public registry you can vet.Like a lobster shell, security has layers — review code before you run it.
latestvk976hw47762a46mw6ztv7ynh8s81c4ja
License
MIT-0
Free to use, modify, and redistribute. No attribution required.