Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Kafka

Manage Kafka topics and data by producing, consuming, monitoring lag, exporting, and running toolkit commands from the CLI.

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 15 · 0 current installs · 0 all-time installs
byBytesAgain2@ckchzh
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
Name/description promise Kafka broker operations (produce, consume, monitor lag). The provided script never speaks to brokers, network, or Kafka APIs — it only records and exports local log entries in a ~/.local/share/kafka directory. This is a clear mismatch: someone wanting Kafka operations would not get them from this skill.
!
Instruction Scope
SKILL.md claims configuration via KAFKA_DIR and lists commands like 'kafka run', 'kafka list', 'kafka add' while the bundled script implements a different set of commands (check, validate, generate, etc.) and ignores KAFKA_DIR (it hardcodes DATA_DIR using HOME). The instructions are therefore inaccurate and grant the agent latitude based on misleading documentation.
Install Mechanism
No install spec or external downloads; the skill is instruction-plus-a-local-script. Nothing is fetched from the network or written outside the user's home directory by default. This is lower risk than remote installers.
Credentials
The skill declares no required env vars or credentials. The script uses HOME implicitly and writes to ~/.local/share/kafka; it does not attempt to read secrets or other environment variables. Requested permissions are proportionate to what the script actually does (file writes).
Persistence & Privilege
always is false and the skill does not attempt to modify other skills or system configurations. It creates and writes files only within a user-local data directory, which is normal for a CLI utility, though it will persist data in that directory.
What to consider before installing
This skill is misleading: it advertises Kafka broker capabilities but the bundled script is just a local logging/devtools tool that writes files under ~/.local/share/kafka and does not talk to Kafka or any external service. If you expected a Kafka integration, do not install — instead look for a skill that requires Kafka connection settings and actually uses Kafka client libraries. If you still want to use this skill, review the full script, test it in an isolated account or VM (so it can't clutter your real environment), and be aware it will create and append logs in your home directory. Do not provide any credentials to this skill — none are required or used.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.0
Download zip
latestvk970wt9300jtxdwp6n0cw6330h831s5h

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Kafka

Kafka toolkit — produce, consume, manage topics, monitor lag, and export data.

Commands

CommandDescription
kafka helpShow usage info
kafka runRun main task
kafka statusCheck current state
kafka listList items
kafka add <item>Add new item
kafka export <fmt>Export data

Usage

kafka help
kafka run
kafka status

Examples

# Get started
kafka help

# Run default task
kafka run

# Export as JSON
kafka export json

Output

Results go to stdout. Save with kafka run > output.txt.

Configuration

Set KAFKA_DIR to change data directory. Default: ~/.local/share/kafka/


Powered by BytesAgain | bytesagain.com Feedback & Feature Requests: https://bytesagain.com/feedback

Files

2 total
Select a file
Select a file to preview.

Comments

Loading comments…