Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Manager

Manager - command-line tool for everyday use

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 24 · 0 current installs · 0 all-time installs
bybytesagain4@xueyetianya
MIT-0
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description match the shipped code: the script implements a local 'manager' CLI that stores logs and exports data. However there are minor inconsistencies: SKILL.md and the script report different version strings (SKILL.md/script show v2.0.0 while registry lists 1.0.1) and SKILL.md claims you can set MANAGER_DIR to change the data directory although the script ignores MANAGER_DIR and always uses ${HOME}/.local/share/manager.
Instruction Scope
SKILL.md stays within the scope of a local manager tool and does not instruct network calls or reading unrelated system state. The mismatch where SKILL.md mentions MANAGER_DIR (not declared in requires.env) is misleading; the script actually reads/writes only under $HOME/.local/share/manager and will log any user-provided input there.
Install Mechanism
No install spec; the skill includes a single bash script. There is no remote download or archive extraction, so nothing arbitrary is pulled from the network at install time.
Credentials
The skill requests no credentials or environment variables. It does implicitly rely on HOME for its data directory. SKILL.md's suggestion to use MANAGER_DIR is not implemented in the script, which is an inconsistency (the script will always use ~/.local/share/manager unless you modify it).
Persistence & Privilege
The skill does not request elevated privileges and is not marked always:true. It persists data to a directory in the user's home (creates and writes log files), which is expected behavior for a local utility but should be noted.
What to consider before installing
This tool appears to be a simple local CLI that stores activity under ~/.local/share/manager and has no network calls or credential requirements. However: (1) the SKILL.md claims you can set MANAGER_DIR to change the data directory but the provided script ignores that — verify and, if needed, edit the script before using; (2) the skill will create and append to multiple .log files and history.log in your home directory, so avoid sending sensitive secrets to it; (3) JSON export is produced without escaping user input and may produce invalid JSON for entries containing quotes/newlines — treat exports accordingly; (4) the package owner/source is unknown and the registry version differs from the script version, so inspect the script contents yourself and consider running it in an isolated environment (container or dedicated user) if you want to test it. If you need the script to honor a custom data directory, either modify it to respect MANAGER_DIR or only run it after changing HOME to a safe folder.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.1
Download zip
latestvk9771we3s6vpx7n7smfsb15hhh8300f4

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Manager

Resource manager — track, organize, list, and maintain any collection of items.

Commands

CommandDescription
manager helpShow usage info
manager runRun main task
manager statusCheck current state
manager listList items
manager add <item>Add new item
manager export <fmt>Export data

Usage

manager help
manager run
manager status

Examples

# Get started
manager help

# Run default task
manager run

# Export as JSON
manager export json

Output

Results go to stdout. Save with manager run > output.txt.

Configuration

Set MANAGER_DIR to change data directory. Default: ~/.local/share/manager/


Powered by BytesAgain | bytesagain.com Feedback & Feature Requests: https://bytesagain.com/feedback

Files

2 total
Select a file
Select a file to preview.

Comments

Loading comments…