Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
entr
v1.0.0Run arbitrary commands when files change. Useful for watching files and triggering builds or tests.
⭐ 0· 2.1k·1 current·1 all-time
byGustavo Madeira Santana@gumadeiras
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description match the SKILL.md content: this skill documents usage of the 'entr' utility to run commands on file changes. It requests no binaries, env vars, or config paths and does not try to perform unrelated actions.
Instruction Scope
Instructions stay on-topic (examples show piping file lists into entr and options). However, by design the tool runs arbitrary utilities/commands when files change — that capability is powerful and could be harmful if the commands provided are unsafe. The SKILL.md also suggests using a 'process' tool to run it in background (agent-specific advice) but does not instruct reading unrelated files or secrets.
Install Mechanism
No install spec—this is instruction-only, so nothing is downloaded or written by the skill itself (lowest install risk).
Credentials
No environment variables or credentials are requested. The only environment reference is that the '-s' option evaluates the command under SHELL, which is expected and proportional.
Persistence & Privilege
always:false (no forced inclusion). disable-model-invocation is false (agent may invoke autonomously), which is the platform default; there is no attempt to modify other skills or system configs.
Assessment
This skill is just documentation for using the external 'entr' program — it does not install anything. Before using or allowing an agent to invoke it: (1) ensure you have the official 'entr' package installed from your OS package manager or trusted source; (2) review and control the exact commands you will run under entr — it will execute arbitrary shell commands on file changes and those commands can be destructive; (3) avoid running watched commands as a privileged user, and prefer testing in a sandboxed or non-production directory first; (4) if you allow autonomous agent invocation, restrict the agent's ability to run destructive commands or limit it to safe wrappers that validate inputs.Like a lobster shell, security has layers — review code before you run it.
latestvk976wr38qaex7rg9rcdh9g3sv97zk02c
License
MIT-0
Free to use, modify, and redistribute. No attribution required.