Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Grocery
v1.0.0Build and manage grocery lists with pantry inventory, household quantities, and dietary restriction safety.
⭐ 3· 648·2 current·2 all-time
byIván@ivangdavila
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the behavior: all operations are local list/pantry management and dietary checks. No unrelated credentials, binaries, or services are requested.
Instruction Scope
Instructions explicitly create and read/write files under ~/grocery/ (memory.md, pantry.md, history.md, stores.md). This is appropriate for a local grocery memory skill, but it does persist personal data (household size, restrictions, preferences) to plaintext files in the home directory.
Install Mechanism
Instruction-only skill with no install spec or code files. No downloads or package installs are performed.
Credentials
No environment variables, credentials, or external config paths are required. The requested data access (user's ~/grocery/ directory) is proportional to the stated functionality.
Persistence & Privilege
The skill persistently stores user data in ~/grocery/. It does not request always:true and does not modify other skills or system-wide settings, but users should be aware that personal info (allergies, household details) is kept on disk until removed.
Assessment
This skill is coherent and low-risk from a code/permission perspective: it stores grocery memory as plaintext files under ~/grocery/ and does not contact external services or request credentials. Before installing, consider: 1) Sensitive data (allergies, household members) will be saved locally—set restrictive file permissions (e.g., chmod 600 ~/grocery/*) or choose a different storage location if needed. 2) Back up or delete ~/grocery/ when you uninstall to remove persisted data. 3) Because it’s an instruction-only skill, there’s no installed binary to inspect, but you can open the SKILL.md, memory-template.md, and lists.md to verify behavior. 4) If you ever see the skill asking to read files outside ~/grocery/ or to send data to an external endpoint, stop and review—those would be unexpected. Overall this appears coherent and appropriate for the stated purpose.Like a lobster shell, security has layers — review code before you run it.
latestvk97b24d3zxhhbg7gc52je08wj181amrr
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🛒 Clawdis
OSLinux · macOS · Windows