Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Merge

Merge - command-line tool for everyday use

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 35 · 0 current installs · 0 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
SKILL.md and the file header advertise a lightweight 'merge' CLI for combining/ exporting local data; the included script implements a larger 'sysops' toolkit (scan, monitor, backup, restore, etc.). The documented top-level commands (merge run, add, list) do not match the script's actual command list. Version in SKILL.md (v2.0.0) differs from registry version (1.0.2). These mismatches suggest sloppy packaging or that the documentation and code are out of sync.
Instruction Scope
The runtime script creates and writes logs under $HOME/.local/share/merge and reads/writes many .log files there. It does not reference external network endpoints or request unrelated system credentials in the visible portion. However the skill bundle is instruction-only (no install) but includes a script that will be present on disk and executed; the SKILL.md commands and examples are inconsistent with the script's actual behavior, which reduces trust. The provided file was truncated in the listing — unseen parts could change the risk profile.
Install Mechanism
No install spec (instruction-only skill) and no downloads or package installs are declared. The only code is a shell script included in the skill bundle, so nothing external is fetched during install according to the metadata.
Credentials
The skill declares no required environment variables or credentials and the script only uses HOME to build a data directory; no external API keys or unrelated secrets are requested. That is proportionate to a local data/logging utility.
Persistence & Privilege
The skill is not marked always:true, does not request elevated privileges, and does not attempt to modify other skills or global agent configuration in the visible code. It does persist data under the user's home directory (~/.local/share/merge).
What to consider before installing
Proceed cautiously. What doesn't add up: the SKILL.md examples and registry metadata don't match the included script (different commands and versions), the skill has no declared homepage in the registry although the docs mention bytesagain.com, and the provided script (visible portion) creates and writes logs in your home directory. Before installing or running: 1) Inspect the full script (the listing was truncated) to confirm there are no network calls, eval/exec of untrusted input, or reads of unrelated system files. 2) Verify the publisher and the bytesagain.com links independently. 3) If you want to test, run it in a restricted/sandbox environment or a throwaway account so file writes are isolated. 4) If you expect only a small 'merge' CLI (run/add/list), ask the author for clarification or a version that matches that minimal surface—the current bundle appears out-of-sync and therefore warrants extra scrutiny.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.2
Download zip
latestvk9734624petkdfdvf2x7h9g3rn83091b

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Merge

Merge toolkit — combine files, resolve conflicts, concatenate data, and deduplicate.

Commands

CommandDescription
merge helpShow usage info
merge runRun main task
merge statusCheck state
merge listList items
merge add <item>Add item
merge export <fmt>Export data

Usage

merge help
merge run
merge status

Examples

merge help
merge run
merge export json

Output

Results go to stdout. Save with merge run > output.txt.

Configuration

Set MERGE_DIR to change data directory. Default: ~/.local/share/merge/


Powered by BytesAgain | bytesagain.com Feedback & Feature Requests: https://bytesagain.com/feedback

Features

  • Simple command-line interface for quick access
  • Local data storage with JSON/CSV export
  • History tracking and activity logs
  • Search across all entries
  • Status monitoring and health checks
  • No external dependencies required

Quick Start

# Check status
merge status

# View help and available commands
merge help

# View statistics
merge stats

# Export your data
merge export json

How It Works

Merge stores all data locally in ~/.local/share/merge/. Each command logs activity with timestamps for full traceability. Use stats to see a summary, or export to back up your data in JSON, CSV, or plain text format.

Support

Powered by BytesAgain | bytesagain.com

Files

2 total
Select a file
Select a file to preview.

Comments

Loading comments…