Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Gemini Workflows
v1.0.0Use Gemini CLI for deep thinking, planning, workflow design, and non-code desktop task orchestration.
⭐ 0· 19·0 current·0 all-time
byDooley@mcdoolz
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md explicitly routes work to the 'gemini' and 'flash' commands and references handing off to the daedalus-code (Claude CLI) skill, which implies use of external CLIs. Yet the skill metadata declares no required binaries, no install steps, and no provenance. A skill that depends on a Gemini CLI should declare that dependency or provide an install mechanism; the omission is inconsistent with the stated purpose.
Instruction Scope
The runtime instructions are limited to routing rules, a prompt template, and handoff steps — they do not ask the agent to read arbitrary files or exfiltrate data. However, the instructions assume the presence of external CLIs and another skill (daedalus-code) without specifying how those will be invoked or what their privileges are. That ambiguity grants the agent broad discretion in how it executes the routing.
Install Mechanism
There is no install spec and no code is written to disk — lowest-risk from an installation perspective. The absence of an install step is consistent with an instruction-only skill, but combined with the undeclared external dependencies it creates operational ambiguity rather than a direct install risk.
Credentials
The skill requests no environment variables, credentials, or config paths, which is proportionate. That said, because the SKILL.md expects use of external CLIs, it should either declare required binaries or document any credentials those CLIs need; the lack of such declarations is an information gap.
Persistence & Privilege
The skill does not request always:true and does not declare elevated persistence or system-wide configuration changes. It is user-invocable and allows autonomous invocation (platform default), which is normal.
What to consider before installing
This skill appears to be a routing/template helper for using a Gemini CLI and handing code work to a Claude CLI, but it does not declare or install the external tools it references. Before installing or enabling it: 1) Confirm you already have a trusted 'gemini' (and 'flash') CLI and the daedalus-code/Claude CLI available on the agent environment — if not, the skill will fail or the agent may attempt to invoke unknown binaries. 2) Verify the provenance of any Gemini/Claude CLI binaries you plan to use (official releases, checksums, vendor docs). 3) Check the daedalus-code skill's permissions and what credentials (if any) it requires. 4) If you need higher assurance, request the skill author to list required binaries and provide an install method or a homepage/source repo. These steps will reduce the risk that the skill silently relies on or attempts to fetch unexpected tools.Like a lobster shell, security has layers — review code before you run it.
latestvk972eq3753n2f0zk0h2qpeh4vn85087c
License
MIT-0
Free to use, modify, and redistribute. No attribution required.