Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Outline

Outline - command-line tool for everyday use

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 43 · 0 current installs · 0 all-time installs
byBytesAgain2@ckchzh
MIT-0
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The script implements a local outline/productivity tool that stores data under ~/.local/share/outline and provides many commands (add, plan, track, review, export, status, etc.), which matches the high-level description. However, SKILL.md lists a different/smaller command set (e.g., 'outline run', 'outline list') and claims an OUTLINE_DIR environment variable to change the data directory; the script does not read OUTLINE_DIR and instead hardcodes DATA_DIR from HOME. This mismatch is unexpected.
Instruction Scope
SKILL.md only instructs running the CLI and mentions data location; it does not direct access to unrelated files or network. The included script likewise only reads/writes files under the data directory and uses standard local utilities (grep, tail, wc, du). The concern is that SKILL.md's runtime instructions (commands and env var usage) are inaccurate relative to the actual script, which could mislead users or agents about behavior.
Install Mechanism
No install spec is provided (instruction-only skill). That is lower risk. The included script would run locally if executed, but there is no remote download or archive extraction in the skill metadata. Standard local binaries are sufficient.
Credentials
The skill declares no required credentials or env vars (appropriate). The script accesses $HOME to build a data directory and writes files there — expected. However, SKILL.md suggests an OUTLINE_DIR env var to change data directory; the script does not honor OUTLINE_DIR. No sensitive environment variables are requested, which is proportional.
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and does not require elevated privileges. It only writes to a per-user data directory under the user's HOME, which is consistent with a local CLI tool.
What to consider before installing
This package appears to be a simple local CLI that stores data in ~/.local/share/outline and performs only local file operations — no network calls or credential requests were found. However, the SKILL.md documentation and the provided script are inconsistent: SKILL.md mentions commands like 'run' and an OUTLINE_DIR env var that the script does not implement. That could be accidental (poor packaging) or cause confusion for an agent following the docs. Before installing or enabling this skill: 1) review the full script yourself (it was included) and ensure its behavior is acceptable; 2) if you expect to change the data directory, note OUTLINE_DIR is not honored — modify the script or set up a symlink instead; 3) test the script in a sandbox or with non-sensitive data; 4) prefer skills with a verifiable source/homepage and matching docs. If you need stronger assurance, ask the publisher for corrected SKILL.md or a signed release.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.2
Download zip
latestvk973zbqgs3w37p39cvhk408rbn830thv

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Outline

Document outline generator — create structured outlines, table of contents, chapter planning, hierarchy management, and export.

Commands

CommandDescription
outline runExecute main function
outline listList all items
outline add <item>Add new item
outline statusShow current status
outline export <format>Export data
outline helpShow help

Usage

# Show help
outline help

# Quick start
outline run

Examples

# Run with defaults
outline run

# Check status
outline status

# Export results
outline export json

How It Works

Tips

  • Run outline help for all commands
  • Data stored in ~/.local/share/outline/

When to Use

  • to automate outline tasks in your workflow
  • for batch processing outline operations

Output

Returns logs to stdout. Redirect to a file with outline run > output.txt.

Configuration

Set OUTLINE_DIR environment variable to change the data directory. Default: ~/.local/share/outline/


Powered by BytesAgain | bytesagain.com Feedback & Feature Requests: https://bytesagain.com/feedback

Files

2 total
Select a file
Select a file to preview.

Comments

Loading comments…