Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Project Ghost

v2.0.0

Web reading layer for AI agents. Convert any public URL into structured intelligence — entities, business intent, confidence score — in one API call.

0· 180·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for sid890-cpu/project-ghost.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Project Ghost" (sid890-cpu/project-ghost) from ClawHub.
Skill page: https://clawhub.ai/sid890-cpu/project-ghost
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install project-ghost

ClawHub CLI

Package manager switcher

npx clawhub@latest install project-ghost
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (web reading layer) aligns with the runtime instructions (POST a URL to an external distill API and receive structured output). However the registry metadata claims no required environment variables while SKILL.md declares a required GHOST_API_KEY — an internal inconsistency in the declared capability/requirements.
Instruction Scope
SKILL.md instructs only to set an API key and POST a public URL to the service; it does not instruct reading local files, shell history, or other unrelated system state. It does, however, direct the agent to transmit the full content (or an extracted form) of arbitrary URLs to a third-party API — expected for this purpose but worth noting for privacy.
Install Mechanism
This is an instruction-only skill with no install spec and no code files, so nothing is written to disk by the skill bundle itself. Low install risk.
!
Credentials
The SKILL.md requires a single secret GHOST_API_KEY (reasonable for an external API), but the registry metadata lists no required env vars — inconsistency that could confuse users. Also the flow requires creating an account/email to obtain the key (privacy/data collection concern). The single API key is proportionate to the stated function, but verify what the external service does with submitted page content.
Persistence & Privilege
The skill does not request always:true and does not modify system-wide settings. It uses normal autonomous invocation defaults. No elevated persistence or cross-skill config access is requested.
What to consider before installing
This skill behaves like a typical web-reading API: it will send URLs (and the page content it extracts) to a third-party service in exchange for structured output, and SKILL.md requires a GHOST_API_KEY even though the registry metadata omitted that. Before installing: 1) Verify the API endpoint and owner — check the linked GitHub repo (https://github.com/Sid890-cpu/project-ghost) and confirm the code and maintainer identity. 2) Confirm the API domain you will be sending pages to (SKILL.md uses project-ghost-production.up.railway.app and project-ghost-lilac.vercel.app) and read its privacy/data-retention policy. 3) Avoid sending private or internal URLs or confidential documents to the service until you’ve confirmed its handling of submitted content. 4) Consider issuing a scoped/test API key or using a throwaway account for initial testing. 5) If the registry metadata is used by your agent to auto-configure secrets, correct the missing GHOST_API_KEY entry or decline install until it's clarified.

Like a lobster shell, security has layers — review code before you run it.

agentsvk9734xfavpw46kpwzsp1k1pdn9836zk8apivk9734xfavpw46kpwzsp1k1pdn9836zk8data-extractionvk9734xfavpw46kpwzsp1k1pdn9836zk8intelligencevk9734xfavpw46kpwzsp1k1pdn9836zk8latestvk9734xfavpw46kpwzsp1k1pdn9836zk8latestwebvk9734xfavpw46kpwzsp1k1pdn9836zk8researchvk9734xfavpw46kpwzsp1k1pdn9836zk8
180downloads
0stars
1versions
Updated 1h ago
v2.0.0
MIT-0

Project Ghost

Web reading layer for AI agents. Convert any public URL into structured, agent-ready intelligence in one API call.

What it does

Feed Ghost any public URL and get back:

  • Business intent — a 1-2 sentence summary of what the page is about
  • Named entities — companies, people, products mentioned
  • Confidence score — how reliable the extraction is (0-1)
  • Tokens saved — how much token reduction vs raw HTML (avg 80%+)
  • Priority score — relevance signal (1-10)

Usage

Read this page and tell me what it's about: https://openai.com
Research Stripe's latest products using Ghost
What are the top stories on Hacker News right now?

How to use in your agent

Set your GHOST_API_KEY environment variable, then call:

curl -X POST https://project-ghost-production.up.railway.app/distill \
  -H "Authorization: Bearer $GHOST_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://apple.com"}'

Response format

{
  "title": "Apple",
  "tokens_saved": "80.7%",
  "signals_data": {
    "decision_signal": {
      "business_intent": "Apple promotes its latest hardware lineup...",
      "priority_score": 8,
      "category": "Technology"
    },
    "items": [
      {
        "title": "MacBook Pro with M5",
        "entities": ["Apple", "MacBook", "M5"],
        "impact_score": 9
      }
    ],
    "integrity_layer": {
      "confidence_score": 0.87,
      "is_high_integrity": true
    }
  }
}

Works great with

  • Research agents reading company websites
  • News monitoring agents tracking topics
  • Sales agents detecting buying signals
  • Legal agents extracting policy terms
  • Any agent that needs to understand web content

Sites that work

Most public websites work — Wikipedia, GitHub, HackerNews, OpenAI, Stripe, Apple, Anthropic, and thousands more.

Sites with enterprise Cloudflare protection (WSJ, FT, Nike) may be blocked — the API returns a clear blocked message in that case.

Get your free API key

Visit project-ghost-lilac.vercel.app → enter your email → get an instant ghost_sk_... key.

Free plan: 100 requests/month. No credit card needed.

Links

Comments

Loading comments...