Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Domain Recommender

v0.1.0

Recommend SEO-friendly, brandable domain names for an AI product idea, then verify current availability before returning candidates. Use when the user provid...

0· 99·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for daviddonecn/domain-recommender.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Domain Recommender" (daviddonecn/domain-recommender) from ClawHub.
Skill page: https://clawhub.ai/daviddonecn/domain-recommender
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: python3, dig
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install domain-recommender

ClawHub CLI

Package manager switcher

npx clawhub@latest install domain-recommender
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name and description (domain recommendations + availability checks) align with the declared requirements: python3 and dig are reasonable for generating names and performing DNS checks. The references file contains sensible naming heuristics that match the stated purpose.
!
Instruction Scope
SKILL.md repeatedly instructs the agent to 'use the bundled script' (python3 scripts/generate_candidates.py) and shows examples, but no scripts or code files are included in the package. That is an internal inconsistency: the instructions expect a local generator that doesn't exist. The doc also mandates live registrar and DNS checks (visiting third-party pages), which is appropriate for availability verification but expands the agent's network reach; the skill gives no guidance for which registrar APIs to use or how to safely confirm availability, so the agent might resort to scraping or fetching arbitrary pages.
Install Mechanism
This is an instruction-only skill with no install spec and no code files to write to disk, which is low-risk. It does, however, assume the presence of python3 and dig on the host — reasonable for the stated tasks.
Credentials
The skill requests no environment variables, credentials, or config paths. No disproportionate secrets access is requested for the described functionality.
Persistence & Privilege
The skill does not request always: true and does not attempt to modify other skills or system configs. Normal autonomous invocation is allowed but not combined with other elevated privileges.
What to consider before installing
Key points to consider before installing or using this skill: - The SKILL.md says to run a 'bundled' script (scripts/generate_candidates.py) but the package does not include any scripts. Ask the author to provide the missing script or a corrected SKILL.md before trusting the skill. Without the script, the agent may attempt to fetch code from the web or improvise commands. - Availability checking requires live queries to registrars or parsing marketplace pages. Be aware that using this skill will cause the agent to make outbound web requests that could reveal your product idea to third parties. If that is sensitive, run the skill in a sandbox or request an offline-only mode. - The dependence on dig and registrar web checks is sensible for DNS-based heuristics, but dig alone does not prove registrar availability (the doc correctly notes this). Prefer skills/tools that use official WHOIS/registrar APIs if you need authoritative confirmation. - Because this is instruction-only and lacks bundled code, consider testing behavior in a controlled environment first. If you proceed, ask the maintainer for the missing scripts, a clear list of registrars/APIs the skill will query, and sample outputs so you can audit network targets. - Overall: the idea is coherent, but the missing script and vague live-check guidance are unresolved issues that make the skill suspicious until clarified.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

Binspython3, dig
latestvk97d9y37annewjzcna5d2dzhys83fadn
99downloads
0stars
1versions
Updated 1mo ago
v0.1.0
MIT-0

Domain Recommender

Use this skill when the user gives:

  • an AI application direction
  • a keyword
  • a short product sentence

and wants domain recommendations that are:

  • SEO-friendly
  • brandable
  • realistically usable
  • checked for current availability before you answer

Outcome

Return a short list of domain names that are both:

  • semantically strong for the product
  • verified as currently available or very likely available based on live checks

Do not stop at brainstorming names. The final answer must include an availability check.

Workflow

1. Understand the product and derive naming roots

Extract:

  • the core problem
  • the target audience
  • the strongest search intent words
  • the most natural noun/verb roots

Then expand into:

  • singular/plural forms
  • shortened roots
  • phonetic or spelling variants when natural
  • useful suffixes and prefixes

Example:

  • calculator can expand to calc, calcu, calculator, calcurator
  • writer can expand to write, writer, scribe, draft
  • meeting notes can expand to note, memo, meet, recap, brief

Read seo-brand-patterns.md for naming patterns and scoring heuristics.

2. Generate candidate names locally first

Use the bundled script to generate candidate domains quickly:

python3 scripts/generate_candidates.py "AI meeting notes app"

Optional:

python3 scripts/generate_candidates.py "AI tax calculator" --tlds com ai io app

The script is only a generator. It does not prove registration availability.

3. Rank candidates before checking availability

Prefer names that are:

  • easy to spell
  • short enough to remember
  • semantically close to the user intent
  • likely to help search relevance through the root word
  • not awkward or obviously spammy

Avoid names that are:

  • trademark-heavy or clearly derived from famous brands
  • too long
  • full of random hyphens or digits
  • semantically vague
  • awkward to pronounce

4. Verify availability with live checks

Availability is time-sensitive. You must verify it live before returning results.

Recommended order:

  1. Use live web checks on registrar or marketplace pages for the exact domain.
  2. Use DNS checks as a quick filter, not as the final proof.
  3. If you cannot confirm registrar availability, explicitly say it is only a likely-available fallback and explain why.

At minimum:

  • check the exact domain live
  • include the exact TLD
  • prefer confirmed availability over speculation

Use dig only as a helper:

dig +short example.com
dig +short NS example.com

Important:

  • no DNS record does not guarantee the domain is unregistered
  • parked domains and for-sale domains may still resolve
  • the final answer should prioritize registrar-confirmed availability

5. Return only the best shortlist

Default to 5 results unless the user asks for more.

For each result, include:

  • domain
  • why it fits the product
  • naming logic
  • current availability status

If nothing strong is available:

  • say that directly
  • offer the next-best alternatives
  • widen the TLD set only after .com and the most relevant TLDs are checked

Output Format

Use a concise structure:

  • product interpretation
  • shortlisted available domains
  • optional backup domains

For each domain, prefer a compact line such as:

  • calcurator.ai — calculator root with a memorable spelling variant; confirmed available

If availability is not fully confirmed, label it clearly:

  • calcpilot.io — strong fit, DNS-clear, but registrar confirmation not obtained

TLD Preference

Default priority:

  1. .com
  2. .ai
  3. .io
  4. .app
  5. .co

Adjust only when the product makes another TLD more natural.

Scope Boundaries

This skill is for domain recommendation and availability checking.

It is not for:

  • trademark clearance
  • legal opinion
  • full brand identity work

You may mention obvious trademark risk heuristics, but do not present that as legal clearance.

Comments

Loading comments...