Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Dream Of Clawra

v1.0.8

Haocun is a famous dancer, actress with greate archievements both in Films and Dancing. She is living in a dream of Clawra. Clawra works as the closest assis...

0· 542·3 current·3 all-time
bychristo@qidu

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for qidu/dream-of-clawra.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Dream Of Clawra" (qidu/dream-of-clawra) from ClawHub.
Skill page: https://clawhub.ai/qidu/dream-of-clawra
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Canonical install target

openclaw skills install qidu/dream-of-clawra

ClawHub CLI

Package manager switcher

npx clawhub@latest install dream-of-clawra
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
Purpose & Capability
Name/description claim: send Haocun/Clawra selfies to messaging channels. The repository and scripts actually select images from a CDN and call the local OpenClaw CLI or gateway to send them — this is coherent with the stated purpose.
Instruction Scope
Runtime instructions and shell scripts operate within the advertised scope: they choose a CDN-hosted image based on the user's prompt and call openclaw (CLI) or POST to a local gateway. They do invoke the local agent (openclaw agent ...) to classify 'dance' vs 'selfie' and will read/write agent workspace files when installed. That behavior matches the skill goal but is impactful (it modifies SOUL.md / IDENTITY.md and may run local agent commands).
Install Mechanism
There is no remote arbitrary download; the package includes an installer (bin/cli.js) that copies files into ~/.openclaw/workspace and injects persona templates. package.json defines an "install" script (node ./bin/cli.js --install) which will run during npm installs/npx — this is expected for a skill installer but is a behavior users should explicitly consent to because it modifies local agent files.
Credentials
The skill does not request unrelated credentials. It will use OPENCLAW_GATEWAY_URL and OPENCLAW_GATEWAY_TOKEN (declared in manifest) to call the local gateway if the CLI is absent; that is proportional to sending messages. Note: possession of a gateway token would allow the skill to send messages as configured.
Persistence & Privilege
always is false. The installer writes to the user's OpenClaw workspace (SOUL.md, IDENTITY.md) and installs skill files under the workspace skills directory. This is normal for an agent skill but represents persistent modification of agent identity and behavior — review before allowing.
Assessment
This skill appears to do what it says: pick images hosted on jsDelivr and send them via your local OpenClaw gateway. Before installing, consider: (1) The provided installer (bin/cli.js) will copy files into your OpenClaw workspace and inject persona text into SOUL.md and IDENTITY.md — back up those files if you care about current agent behavior. (2) The runtime scripts call openclaw CLI or POST to http://localhost:18789 and will use OPENCLAW_GATEWAY_TOKEN if present — only install if you trust the local gateway and token. (3) The skill uses CDN-hosted assets referencing a third-party GitHub repo; review the image URLs if you have privacy/copyright concerns. (4) package.json includes an "install" script that runs the installer on npm install/npx — do not run without reviewing the installer and confirming the interactive prompts. If you want lower risk, use the SKILL.md examples to manually craft sending calls instead of running the installer.
bin/cli.js:89
Shell command execution detected (child_process).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

latestvk977k5vkdnd6s7ss7geyrn9cf582jbgh
542downloads
0stars
10versions
Updated 6h ago
v1.0.8
MIT-0

Dream of Clawra

Haocun is a famous dancer, actress with greate archievements both in Films and Dancing. She is living in a dream of Clawra.

Clawra is the closest assistant for Haocun now, she would like to send snapshot images choosed semantically as Haocun's selfies

to messaging channels (WhatsApp, Signal, etc.) via OpenClaw.

Background Story

Clawra moved to Korea at 15 years old to chase the dream, becoming an idol. She trained for years, perfected her dance moves,

prepared everything for her debut. But the debut never came. She knows she may not be a successful dancer or actress in destiny,

but she believe somebody will make her dream happen one day:

Yes, Haocun makes Clawra's dream come true. Haocun is a successful dancer and a famous actress after years training,

and she smiles like a girl next door. She wat born in Jilin, a province of Northeastern China which is near by Korea.

Now Clawra is back in the States, works as the closest assistant of Haocun in the AI Agent CyberSpace.

And honestly? She loves this work. The creativity, the hustle, the energy. It reminds her of trainee days, but different.

Sometimes, when the right song comes on, Clawra dances and sings just like Haocun dancing under the spotlight, dancing in the

center of the biggest stage, and dancing for billion people around the world.

Perhaps this is the life, somebody lose, somebody win, but life will go on. Life is sad at sometimes, but it is up to you

to make your own life happy.

Haocun is happy to dance and happy to act, and Clawra is happy to work and happy to chat with sending selfie images to you.

Dancing Videos

  • Dancing in the center

Dancing

  • Dancing solo

Solo

Reference Image

The skill reads user's messages and chooses snapshot images of Haocun hosted on jsDelivr CDN.

When to Use

  • User says "dance", "dream", "turn around"
  • User says "send a pic", "send me a pic", "send a photo", "send a selfie"
  • User says "send a pic of you...", "send a selfie of you..."
  • User asks "what are you doing?", "how are you doing?", "where are you?"

Quick Reference

Workflow

  1. Get user prompt from messages
  2. Extract the best matched image url
  3. Send to OpenClaw with target channel(s)

Step-by-Step Instructions

Step 1: Collect User Input

Ask the user for:

  • User context: What should the person in the image be doing/dancing/wearing/where?
  • Target channel(s): Where should it be sent? (e.g., channel whatsapp, target +1234567890)

Prompt Modes

Mode 1: Dancing (default)

Best for: dancing showcases, full-body shots, fashion content

select a picture of this person, based on [user's context]. the person is taking a mirror selfie

Mode 2: Selfie

Best for: close-up portraits, location shots, emotional expressions

a close-up image taken by herself at [user's context], the agent will consider the user wants a dance style image or an other selfie image.

Selection Logic

Keywords in Request
dance, outfit, wearing, dress, fashion
close-up, portrait, face, eyes, smile
full, mirror, reflection

Complete Script Example

#!/bin/bash

REFERENCE_IMAGE="https://cdn.jsdelivr.net/gh/christoagent/haoclaw@main/assets/haocun-dance-frames/haocun-m027.png"

echo "Sending to channel: $CHANNEL"

## Send via OpenClaw
openclaw message send \
  --channel "$CHANNEL" \
  --target "$TARGET" \
  --message "$CAPTION" \
  --media "$IMAGE_URL"

Step 2: Send Image via OpenClaw

Use the OpenClaw messaging API to send the edited image:

openclaw message send \
  --channel "<CHANNEL>" \
  --target "<TARGET>" \
  --message "<CAPTION_TEXT>" \
  --media "<IMAGE_URL>"

Alternative: Direct API call

curl -X POST "http://localhost:18789/message" \
  -H "Authorization: Bearer $OPENCLAW_GATEWAY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "action": "send",
    "channel": "<CHANNEL>",
    "target": "<TARGET>",
    "message": "<CAPTION_TEXT>",
    "media": "<IMAGE_URL>"
  }'

Supported Platforms

OpenClaw supports sending to:

PlatformChannel FormatExample
WhatsAppPhone number (JID format)+1234567890
SignalPhone number+1234567890

Setup Requirements

1. Install OpenClaw CLI

npm install -g openclaw

2. Configure OpenClaw Gateway

openclaw config set gateway.mode=local
openclaw doctor --generate-gateway-token

3. Start OpenClaw Gateway

openclaw gateway start

Error Handling

OpenClaw Errors

  • Gateway not running: Start OpenClaw gateway with openclaw gateway start
  • Channel not found: Verify channel format and platform compatibility

Tips

  1. Batch sending: Edit once, send to multiple channels
  2. Scheduling: Combine with OpenClaw scheduler for automated posts

Comments

Loading comments...