Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Motie CLI

v1.0.2

Discover and explore APIs on the Motie marketplace using the motie CLI. Use this skill whenever you need to find an API or service to accomplish a task — res...

0· 97·0 current·0 all-time
byCristian Saucedo@saucedocs

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for saucedocs/motie-cle-beta.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Motie CLI" (saucedocs/motie-cle-beta) from ClawHub.
Skill page: https://clawhub.ai/saucedocs/motie-cle-beta
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install motie-cle-beta

ClawHub CLI

Package manager switcher

npx clawhub@latest install motie-cle-beta
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The SKILL.md clearly requires a Motie API key (MOTIE_API_KEY) and instructs use of the '@saucedocs/motie-cli' npm package, but the skill's registry metadata declares no required environment variables, no primary credential, and no install spec. That mismatch is unexpected: a Motie CLI skill legitimately needs the MOTIE_API_KEY and should have declared it.
Instruction Scope
The runtime instructions are narrowly focused on searching, fetching docs, and calling APIs via the motie CLI and do not ask the agent to read unrelated files or credentials. They do instruct checking the MOTIE_API_KEY env var (or passing --api-key) and to install the CLI with npm; that behavior is in-scope but the skill grants broad discretion to invoke arbitrary marketplace APIs (as intended for discovery).
!
Install Mechanism
There is no formal install spec in the skill bundle, but the SKILL.md tells users/agents to run 'npm install -g @saucedocs/motie-cli'. The package scope (@saucedocs) and name are provided but the skill lists no homepage, repository, or source. Asking users/agents to install a third‑party global npm package with no declared source increases risk and should be verified (authentic package, publisher, and package contents).
!
Credentials
The instructions require MOTIE_API_KEY (starts with 'mtk_'), which is the only credential needed for the CLI, but the skill metadata did not declare this env var or a primary credential. This omission reduces transparency and means agents might prompt users for secrets that the registry didn't declare. No other unrelated credentials are requested.
Persistence & Privilege
The skill is instruction-only, has no install behavior in the bundle, and 'always' is false. It does not request permanent presence or elevated platform privileges in the manifest.
What to consider before installing
This skill appears to do what it says (discover and call Motie marketplace APIs) but has two practical issues you should resolve before installing or following its instructions: 1) verify the npm package '@saucedocs/motie-cli' (check its npm page, repository, publisher identity, and recent release history) because the skill bundle provides no homepage or source; 2) be aware the CLI requires your MOTIE_API_KEY — treat that like any API secret: only provide it to a trusted CLI/package, avoid pasting it into untrusted interfaces, and prefer using a scoped key with least privilege. Ask the publisher for a repository/homepage and for the skill metadata to be updated to declare MOTIE_API_KEY explicitly; if you don't trust the npm package, do not run global installs and consider running the CLI in an isolated container or sandbox for testing.

Like a lobster shell, security has layers — review code before you run it.

latestvk97dd1e8ssy13zg286dkk2natn84y8vz
97downloads
0stars
2versions
Updated 1w ago
v1.0.2
MIT-0

Motie CLI — API Discovery Tool

You have access to the motie CLI tool for discovering and calling APIs published on the Motie marketplace. Use it whenever you need an external API to accomplish a task.

Setup

The CLI requires a Motie API key (starts with mtk_). Check if MOTIE_API_KEY is set in the environment. If not, tell the user to get one at https://beta.motie.dev under Profile > API Key > Generate API Key, then set it:

export MOTIE_API_KEY=mtk_your_key_here

Alternatively, pass --api-key to each command.

The CLI is installed via: npm install -g @saucedocs/motie-cli

Workflow

Always follow this sequence:

Step 1: Search for an API

motie search "<descriptive query>"

Use natural language — the search is semantic (embedding-based), so descriptive queries like "find restaurant availability and reservations" work better than single keywords.

Options: --category <cat>, --tags <tags> (comma-separated), --limit <n> (1-100, default 20)

Response:

{
  "listings": [
    {
      "id": "abc-123",
      "name": "Restaurant Availability API",
      "short_description": "Real-time restaurant search and reservation availability",
      "category": "content_monitoring",
      "tags": ["restaurants", "reservations"],
      "published_at": "2026-04-03T19:42:55.318Z"
    }
  ],
  "total": 1
}

Step 2: Get docs for a listing

Use the id from search results to fetch full API documentation:

motie docs <listing-id>

This returns all available routes with their parameters, request/response schemas, and an example_cli command you can run directly. Read the response carefully — it tells you exactly how to call the API.

Response (abbreviated):

{
  "listing": { "id": "...", "name": "...", "description": "..." },
  "api": {
    "base_url": "https://example.execute-api.us-east-2.amazonaws.com",
    "routes": [
      {
        "method": "GET",
        "path": "/v1/restaurants/search",
        "description": "Search for restaurants by name or cuisine",
        "parameters": [
          { "name": "query", "required": true, "type": "string" },
          { "name": "location", "required": false, "type": "string | null" }
        ],
        "request_body": null,
        "response_schema": [ { "id": "string", "name": "string" } ],
        "example_cli": "motie call abc-123 /v1/restaurants/search --query <query> [--location <location>]"
      }
    ]
  }
}

Step 3: Call the API

Use motie call to invoke any route directly:

motie call <listing-id> <route-path> --<key> <value> ...

Pass all parameters as flags — the CLI automatically places each parameter in the right location (query string, URL path, or request body) based on the route documentation.

Options: --method <METHOD> (auto-detected if omitted), --api-key <key>, --base-url <url>

Examples:

# GET with query params
motie call abc-123 /v1/restaurants/search --query "italian food" --location NYC

# GET with path param
motie call abc-123 /api/v1/airports/{iata} --iata LAX

# POST with body params (method auto-detected)
motie call abc-123 /api/v1/flight-searches --origin_iata LAX --destination_iata JFK --date 2026-05-01

Error handling

All errors output JSON to stderr with exit code 1:

{"error": "Missing API key. Set MOTIE_API_KEY or pass --api-key."}

Comments

Loading comments...