Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Keybindings Customizer
v1.0.0Use when the user wants to customize Claude Code keybindings, rebind shortcuts, add chords, or edit `~/.claude/keybindings.json` safely.
⭐ 0· 21·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The skill is described as a keybindings editor and its runtime instructions explicitly reference editing ~/.claude/keybindings.json and reading the existing keybindings file. However, the skill metadata lists no required config paths. That is an inconsistency: the skill will need filesystem access to a specific user config but didn't declare it.
Instruction Scope
SKILL.md instructs the agent to read the current keybindings file, merge changes, preserve schema/docs, and validate reserved shortcuts — all appropriate for this purpose. It does not direct network exfiltration or access to unrelated files. However it is somewhat vague about how to determine 'OS or terminal constraints' and does not state whether the agent must ask the user for confirmation before writing the file or whether it will write changes directly.
Install Mechanism
Instruction-only skill with no install spec or bundled code — low install risk (nothing is written to disk by an install process).
Credentials
No environment variables or credentials are requested, which is appropriate. However the skill will read and write a user config file in the home directory; that access is not declared in the metadata's config paths and should have been. The requested access is proportionate to the task but the missing declaration is a transparency issue.
Persistence & Privilege
always is false and there are no indications the skill requests persistent/privileged presence or modifies other skills. Autonomous invocation is allowed by default but not by itself a concern here.
What to consider before installing
This skill appears to do what it says (merge changes into ~/.claude/keybindings.json) but the package metadata did not declare that config path. Before installing or running it: (1) make a backup copy of ~/.claude/keybindings.json; (2) require the agent to show the merged config and ask your explicit approval before saving; (3) confirm the skill will run locally and will not send file contents to external endpoints (SKILL.md contains no network steps, but provenance is sparse); (4) if you are unsure, ask the skill owner to add the config-path declaration and an explicit confirmation step in SKILL.md so you can review changes before they are written.Like a lobster shell, security has layers — review code before you run it.
claude-codevk973q79vpk2x3p21qjmzn5wzc5843s81extractedvk973q79vpk2x3p21qjmzn5wzc5843s81latestvk973q79vpk2x3p21qjmzn5wzc5843s81
License
MIT-0
Free to use, modify, and redistribute. No attribution required.