Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Lark Openclaw Bridge
v1.0.0Classifies and appends user memos to categorized Markdown files under ~/.memo when triggered by /private-secretary or /ps commands.
⭐ 0· 121·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name and description claim a local memo classifier/writer and the instructions only require creating/appending files under ~/.memo — this is coherent with the stated purpose.
Instruction Scope
The SKILL.md explicitly instructs the agent to use the exec tool to run shell commands that append to ~/.memo/{category}.md, which is a direct and reasonable way to implement the feature. However the 'rearrange' capability is underspecified (it says 're-classifies and reorganizes all memos under ~/.memo' but provides no concrete commands or limits). That vagueness gives the agent broad discretion to read and modify many files under the user's home directory, and an exec-based workflow could be abused to run other shell commands if the agent deviates or is compromised.
Install Mechanism
Instruction-only skill with no install spec or external downloads — lowest risk from installation perspective.
Credentials
No environment variables, credentials, or config paths are requested; the only filesystem access implied is to ~/.memo which matches the described purpose.
Persistence & Privilege
always:false and user-invocable:true (normal). The skill allows autonomous model invocation by default (platform default) — combine that with exec usage and the vague 'rearrange' behavior to assess risk before enabling autonomous runs.
What to consider before installing
This skill appears to do what it says (write classified memos to ~/.memo) but you should be cautious because it asks the agent to run shell commands and has an underspecified 'rearrange' operation that could cause wider file reads/writes. Before installing: (1) verify the skill source or ask the author for an explicit, auditable implementation of 'rearrange' (concrete commands), (2) limit or audit the agent's exec capability (prefer returning text for you to run instead of granting automatic exec), (3) back up ~/.memo, and (4) if you enable autonomous invocation, prefer running it in a restricted/sandboxed environment or only after reviewing each command the agent will run. If you are unsure, do not grant the skill broad exec/shell access.Like a lobster shell, security has layers — review code before you run it.
latestvk9794r1wngbdq1k8gqmdjg3ha1834tkq
License
MIT-0
Free to use, modify, and redistribute. No attribution required.