Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Config Manager
v1.0.0Safe configuration file editing for JSON, YAML, TOML, and other config formats. Use when working with configuration files for: (1) Reading config values, (2)...
⭐ 0· 88·1 current·1 all-time
bydougchambers@dougchambes
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name and description align with the provided instructions and reference material: operations for reading, updating, validating, converting, and merging common config formats are all covered and expected.
Instruction Scope
The SKILL.md includes many shell commands that operate on files (jq, yq, sed, cp, mv, python snippets) but examples reference generic filenames (config.json, config.yaml) rather than enforcing a confined path. Although a safety rule says 'Only touch ~/openclaw configs', the examples and commands do not programmatically constrain operations to that directory. The instructions also recommend running package installs and downloading binaries (sudo apt, brew, pip, wget) which could change system state or require elevated privileges.
Install Mechanism
There is no formal install spec (instruction-only), which reduces supply-chain risk. However the included references explicitly instruct installing tools (apt/brew/pip, wget + GitHub release for yq). Those are normal for a CLI-focused guide but mean the agent (or user following agent guidance) may download and install software from the network and use sudo.
Credentials
The skill requests no environment variables, no credentials, and no protected config paths. That is proportionate to its described functionality.
Persistence & Privilege
The skill is not always-enabled and does not request system-wide privileges from its metadata. The instructions may result in package installs or file edits if executed, but the skill itself does not declare persistent or elevated platform privileges.
What to consider before installing
This skill appears to be what it claims (a how-to guide for safely editing config files) but be cautious: it's instruction-only, so the agent following it will run shell commands that can modify files and install software. Before using, verify or enforce these points: 1) limit actions to a safe directory (e.g., ~/openclaw) — prefer absolute paths or sandboxing; 2) do not run commands with sudo or allow global package installs unless you explicitly want system-wide changes; 3) review any wget/pip commands before running (they download and execute code); 4) avoid passing secrets or system config files to the skill; and 5) if you want automated edits, prefer running the commands yourself or in a constrained container with limited privileges. If you need higher assurance, ask the author to remove/instrument install instructions, lock all file operations to a specific workspace path, and provide an explicit safety checklist for elevation and network operations.Like a lobster shell, security has layers — review code before you run it.
latestvk97b9zwsjfvxtgermgykvqs9hh83btze
License
MIT-0
Free to use, modify, and redistribute. No attribution required.