Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Pilot S3 Bridge
v1.0.0Access cloud storage (S3, GCS, Azure Blob) through a Pilot bridge agent. Use this skill when: 1. You need to transfer files to/from cloud storage via Pilot a...
⭐ 0· 0·0 current·0 all-time
byCalin Teodor@teoslayer
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims to bridge S3/GCS/Azure via a Pilot agent and declares pilotctl as a required binary, which is coherent. However, the runtime instructions also rely on aws (AWS CLI), jq and potentially gsutil/az CLI for other clouds, plus exporting cloud credentials — none of these are declared in the metadata. The undeclared dependencies are disproportionate to the declared requirements and should have been declared.
Instruction Scope
SKILL.md contains concrete shell code that: starts a public pilot daemon, runs an infinite listen loop, writes received payloads to /tmp and runs aws s3 cp using BUCKET/KEY values from incoming messages, and instructs manual export of AWS keys. It also sends raw command output back to send-message (unescaped), which can leak data or cause parsing problems. The instructions explicitly require reading environment variables and executing network/cloud commands outside what the metadata advertised.
Install Mechanism
This is an instruction-only skill with no install spec or files written at install time, which minimizes install-time risk. The runtime still depends on external CLIs (pilotctl, aws, jq, possibly gsutil/az) being present on PATH.
Credentials
The SKILL.md tells operators to export AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (and references other cloud CLIs), but the skill metadata declares no required environment variables or primary credential. Requesting cloud credentials is reasonable for a bridge, but the omission in metadata is a mismatch and the skill gives no guidance on limiting scope (least privilege, using short-lived creds, or roles).
Persistence & Privilege
The skill does not request always:true, but the example instructs running pilotctl daemon start --public and a persistent listener loop, which exposes the agent to incoming network messages. Making the daemon public increases the attack surface and amplifies the impact of any credential misuse or malformed requests.
What to consider before installing
This skill looks like it does what it says (bridge cloud storage via a Pilot agent) but the SKILL.md and the registry metadata don't match. Before installing or running it: 1) don't export long-lived AWS keys into a shell without careful thought — prefer IAM roles, short-lived tokens, or scoped service accounts and grant the bridge only the minimum permissions (specific buckets/prefixes and only required actions). 2) Ensure required binaries (aws CLI, jq, and any cloud CLIs you need) are installed and come from trusted sources; update the skill metadata to list them. 3) Avoid running the daemon with --public unless you understand the network exposure; prefer private network/VPC or firewall rules and rate limits. 4) Review and test the loop in an isolated environment (no production credentials) to verify it doesn't leak local data or accept dangerous commands from untrusted senders; the skill currently forwards raw aws/ls output back to send-message without escaping. 5) Ask the publisher for an updated SKILL.md/metadata that declares required env vars and CLIs, documents recommended credential handling, and clarifies security considerations. If you cannot obtain those clarifications, treat the skill as risky and run only in a well-restricted, monitored environment.Like a lobster shell, security has layers — review code before you run it.
latestvk970jte0gw7danhfzcy0mnvq9d84hyzp
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binspilotctl