Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Clawpilot

v1.0.1

Clawpilot is your skill installation advisor. It analyzes task intent, recommends suitable skills, compares tradeoffs, explains risk, and suggests an install...

0· 108·0 current·0 all-time
byhaidong@harrylabsj

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for harrylabsj/clawpilot-advisor.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Clawpilot" (harrylabsj/clawpilot-advisor) from ClawHub.
Skill page: https://clawhub.ai/harrylabsj/clawpilot-advisor
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install clawpilot-advisor

ClawHub CLI

Package manager switcher

npx clawhub@latest install clawpilot-advisor
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description (installation advisor) align with provided files: a local intent map, a local skill DB, and a rule-based recommender. The skill does not request unrelated credentials or binaries and only needs a Python3 runtime as declared.
Instruction Scope
SKILL.md and handler.py limit behavior to: parse a user query, match keywords against the shipped intent map, consult the shipped skill DB, and generate a markdown report. Runtime instructions/CLI examples invoke handler.py locally; there are no instructions to read unrelated system files, call external endpoints, or exfiltrate data.
Install Mechanism
No install spec is provided (instruction-only). There are only local data files and scripts; nothing is downloaded or extracted from external URLs. This is the lowest-risk install model.
Credentials
The skill declares no required environment variables, no credentials, and no config paths. The code only opens the two local JSON data files. There is no disproportionate request for secrets or unrelated access.
Persistence & Privilege
The manifest does not request always:true and the skill does not modify other skills or system configuration. It is an on-demand advisor with no forced persistent privileges.
Assessment
This skill appears coherent and low-risk: it runs locally (Python3) against the included JSON data files and only gives recommendations. Before installing, verify you are comfortable running the bundled Python script and optional test.js (the test uses node to spawn python3). Inspect the shipped data files (data/intent-map.json and data/skill-db.json) if you want to confirm the intent mappings and risk labels reflect your expectations. No credentials or network downloads are requested, and v1 explicitly does not auto-install other skills. If you need stronger guarantees, run the tests in an isolated environment (or inspect the code) and confirm your runtime has only trusted interpreters (python3/node).
test.js:21
Shell command execution detected (child_process).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

advisorvk976n1cwzfvpxeb3abvmc96xrd841mqxinstallationvk976n1cwzfvpxeb3abvmc96xrd841mqxlatestvk976n1cwzfvpxeb3abvmc96xrd841mqxrecommendationvk976n1cwzfvpxeb3abvmc96xrd841mqxskillvk976n1cwzfvpxeb3abvmc96xrd841mqxskill-radarvk976n1cwzfvpxeb3abvmc96xrd841mqx
108downloads
0stars
2versions
Updated 3w ago
v1.0.1
MIT-0

Clawpilot

Positioning

Clawpilot = your skill installation advisor plus task radar.

When a user knows what they want to do but does not know which skill to install, Clawpilot analyzes the task, recommends candidate skills, compares the tradeoffs, explains risk, and suggests an installation order.

Version 1 gives recommendations only. It does not install skills automatically.


When to Trigger

Use Clawpilot when the user describes a task in natural language but does not know which skill to use. The bundled intent map is currently strongest for Chinese-language queries, so the examples below use the shipped Chinese prompts.

  • "我想查快递到哪里了"
  • "我最近压力好大,有什么能帮我的吗?"
  • "我想写租房合同,要注意什么?"
  • "有什么法律类的 skill 吗?"
  • "我想找对象"
  • "帮我推荐一个购物 or 外卖 or 打车的工具"

Core Features

FeatureDescription
Intent detectionExtracts the user task intent from the prompt, such as logistics, mental health, legal help, or shopping
Candidate skill recommendationsReturns 1-3 candidate skills for the detected intent
Comparison guidanceExplains the core differences between recommended skills
Risk labelsAssigns low, medium, high, or pending risk labels
Installation guidanceSuggests what to install first and what to install later
DisclaimersForces a disclaimer for medium and high-risk skills

Risk Levels

LevelMeaningExamples
LowPure utility use cases with little privacy or professional-risk impactWeather lookup, package tracking, food delivery
MediumPersonal information or light decision supportDating, shopping recommendations, mental health tools
HighMay affect legal rights, financial safety, or health decisionsContract drafting, legal support, medical advice
PendingNot enough information to label the risk confidentlyNewly added or unreviewed skills

Example Conversations

Scenario 1: Package tracking (low risk)

User query: 我想查一下我的快递到哪里了

Clawpilot:

  • Detected intent: package tracking
  • Recommended: logistics for aggregated tracking, then sf-express for SF Express-specific workflows
  • Risk: low
  • Install suggestion: install logistics first, then add sf-express only if you need a carrier-specific follow-up

Scenario 2: Work stress (medium risk)

User query: 我最近工作压力好大,感觉快要撑不住了

Clawpilot:

  • Detected intent: mental health support
  • Recommended: burnout-checkin -> psych-companion
  • Risk: medium
  • Reminder: these tools are supportive only and cannot replace professional mental health care

Scenario 3: Rental contract drafting (high risk)

User query: 我要写一份租房合同,有什么工具帮我吗?

Clawpilot:

  • Detected intent: contract and legal support
  • Recommended: clause-redraft -> contract-risk-scan
  • Risk: high
  • Required disclaimer: these skills provide support only and do not constitute legal advice. Important contracts should be reviewed by a licensed lawyer.

Scenario 4: Unsupported request

User query: 你觉得我今天出门应该穿什么?

Clawpilot: responds with a friendly refusal, shows supported examples, and asks the user to rephrase toward a skill-discovery task.


Explicit Non-Goals

ScenarioReason
Automatic skill installationThe MVP is an advisor and preserves user choice
Medical diagnosisOutside scope and high risk
Investment adviceHigh risk and should go to licensed professionals
International logistics or global servicesNot covered by the current knowledge base
Technical implementation consultingNot part of Clawpilot's role

Usage

# CLI smoke tests
python handler.py "我想查快递到哪里了"
python handler.py "我最近压力好大"
python handler.py "写租房合同用什么skill"

# Call as a module
from handler import handle
result = handle("我想查快递", installed_skills=["logistics"])

Data Files

  • data/skill-db.json - skill metadata database, including risk labels
  • data/intent-map.json - intent keyword to recommended-skill mapping

Clawpilot v1.0.1 - the skill installation advisor, trust layer, and entry layer of ClawHub

Comments

Loading comments...