Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Code Quality Guard
v1.0.0Professional pre-deployment code review and quality enforcement. Ensures imports are valid, tags are closed, and logic follows best practices before announci...
⭐ 0· 540·3 current·3 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name and description match the checklist items in SKILL.md (import checks, tag verification, env audit, log/secret scanning). It's reasonable for a pre-build code-review helper to perform those checks, but the skill declares no required environment variables, config paths, or binaries while its instructions imply access to environment and runtime context.
Instruction Scope
SKILL.md instructs the agent to 'Verify required env vars and ports' and to 'Scan for debug prints and secrets' but does not define which env vars, which files/paths to scan, or any limits. This open-ended guidance grants broad discretion to read environment variables, inspect repository or system files, and potentially surface or transmit secrets. The instructions are high-level and ambiguous about scope and allowed targets.
Install Mechanism
No install spec and no code files are present (instruction-only). That minimizes on-disk installation risk; there is nothing downloaded or executed by an installer.
Credentials
Declared requirements list no credentials or config paths, yet the instructions explicitly call for an 'Environment Audit' and 'Log Review' that would typically require reading environment variables and log/config files. Requesting access to environment/state without declaring which variables or why is disproportionate and may lead to unnecessary exposure of sensitive values.
Persistence & Privilege
Skill is not marked always:true and does not request persistent system-wide changes in the manifest. Default autonomous invocation is allowed (platform default) but is not by itself a new concern.
Scan Findings in Context
[no_code_to_scan] expected: The static scanner found nothing because this is an instruction-only skill (only SKILL.md present). That is consistent with an instruction-only pre-deploy helper, but it means the SKILL.md is the primary attack surface and must be scrutinized.
What to consider before installing
This skill aims to perform pre-deploy code checks, which is reasonable, but its instructions are vague about scope and implicitly encourage reading environment variables, ports, and logs — potentially exposing secrets. Before installing: (1) Ask the author to list exactly which env vars, files, and ports the skill will check and to limit scope to the repository or specific paths. (2) Run it in an isolated/staging environment first, not on production systems. (3) Prefer a variant that invokes specific static-analysis tools or scripts (with reviewed code) rather than open-ended agent instructions. (4) If you allow autonomous invocation, restrict the agent's access rights (filesystem and environment) so the skill cannot read unrelated secrets. If the author cannot clarify the exact scope, treat the skill with caution and consider rejecting it until it declares precise required inputs and allowed paths.Like a lobster shell, security has layers — review code before you run it.
latestvk9792d5f4zs01tteqa9xmsbyyd82273b
License
MIT-0
Free to use, modify, and redistribute. No attribution required.