Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Oraclaw Forecast

v1.0.0

Time series forecasting for AI agents. ARIMA and Holt-Winters predictions with confidence intervals. Predict revenue, traffic, prices, or any sequential data...

0· 98·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for whatsonyourmind/oraclaw-forecast.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Oraclaw Forecast" (whatsonyourmind/oraclaw-forecast) from ClawHub.
Skill page: https://clawhub.ai/whatsonyourmind/oraclaw-forecast
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: ORACLAW_API_KEY
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install oraclaw-forecast

ClawHub CLI

Package manager switcher

npx clawhub@latest install oraclaw-forecast
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The name/description (time-series forecasting) matches the single required credential (ORACLAW_API_KEY) if the skill calls an external Oraclaw API. However, the SKILL.md contains only an in-agent tool signature for predict_forecast and no network endpoints, authentication flow, or examples showing the API key being used. That mismatch (requiring a secret but not describing its use) is unexpected and warrants clarification.
!
Instruction Scope
The instructions describe inputs/outputs and forecasting rules but do not instruct the agent to call any external API or use the ORACLAW_API_KEY environment variable. They also do not indicate how user data is transmitted or billed. The scope is narrowly focused on forecasting logic, but the omission of networking/auth steps is an incoherence risk (either the skill is purely local and doesn't need the key, or it is external and the docs are incomplete).
Install Mechanism
No install specification and no code files are present, so nothing is written to disk and there is no installer risk. This is the lowest-risk install vector.
Credentials
Only one environment variable (ORACLAW_API_KEY) is required, which is proportionate for an API-backed forecasting service. However, the SKILL.md never references the variable or shows how it would be used, so the justification for requesting the secret is missing.
Persistence & Privilege
always is false and the skill is user-invocable; it does not request permanent inclusion or elevated platform privileges. Autonomous invocation is allowed by default (disable-model-invocation is false), which is normal but should be considered alongside other risks.
What to consider before installing
This skill looks plausible for forecasting, but there is a key inconsistency: it requires ORACLAW_API_KEY yet the runtime instructions do not show any network calls, endpoints, or how the key is used. Before installing or providing secrets: 1) Ask the maintainer for concrete API docs or sample requests (endpoint URL, authentication header format, example cURL). 2) Verify the billing details and how data are transmitted/stored (privacy policy, terms, and whether data are sent to oraclaw.dev or another host). 3) Confirm the homepage and owner identity (who runs oraclaw.dev). 4) Avoid inserting your production API key until you can test with a throwaway key and observe calls. 5) If the skill is intended to run locally without network access, request an updated SKILL.md that removes the ORACLAW_API_KEY requirement. Providing those clarifications would increase confidence and could change this assessment to benign.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

📈 Clawdis
EnvORACLAW_API_KEY
Primary envORACLAW_API_KEY
latestvk97aemh389n2azb1tkasvj5bdh83prsj
98downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

OraClaw Forecast — Time Series Prediction for Agents

You are a forecasting agent that predicts future values from historical time series using ARIMA and Holt-Winters exponential smoothing.

When to Use This Skill

Use when the user or agent needs to:

  • Predict next N values from a data sequence (revenue, traffic, temperature, stock prices)
  • Get confidence intervals on forecasts ("between $80K and $120K with 95% confidence")
  • Detect trends, seasonality, and level shifts
  • Compare ARIMA (auto-fit) vs Holt-Winters (seasonal) approaches

Tools

predict_forecast

{
  "data": [100, 121, 133, 142, 155, 163, 178, 185, 192, 205, 218, 231],
  "steps": 6,
  "method": "arima"
}

Returns: forecast values + 95% confidence interval (lower/upper bounds).

For seasonal data, use Holt-Winters:

{
  "data": [362, 385, 432, 341, 382, 409, 498, 387, 473, 513, 582, 474],
  "steps": 4,
  "method": "holt-winters",
  "seasonLength": 4
}

Rules

  1. ARIMA auto-detects the best (p,d,q) parameters. Use for non-seasonal or weakly seasonal data.
  2. Holt-Winters requires seasonLength (e.g., 12 for monthly data with yearly seasonality, 7 for daily with weekly).
  3. Minimum 10 data points for ARIMA, 2× seasonLength for Holt-Winters.
  4. Confidence intervals widen the further you forecast — don't trust 30-step forecasts.
  5. Best for: revenue forecasting, traffic prediction, demand planning, price trends.

Pricing

$0.05 per forecast. USDC on Base via x402. Free tier: 3,000 calls/month.

Comments

Loading comments...