Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
proxymock
v1.0.0Record, inspect, mock, replay, and generate API traffic using the proxymock CLI. Use when the user wants to capture HTTP/gRPC/database traffic, create mocks...
⭐ 0· 575·0 current·0 all-time
byMatthew LeRay@mleray24
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name and description match the instructions and included script: proxymock is explicitly a traffic-recording/replay/mocking CLI and the SKILL.md and script call the proxymock binary and describe ports, RRPair files, and replay workflows. The functionality requested is coherent with the stated purpose.
Instruction Scope
Instructions direct the agent/user to run proxymock to capture inbound/outbound traffic (via local proxies on ports 4140/4143) and to set proxy env vars when not using child-process mode. This is expected for the stated purpose but means the tool will see full request/response payloads (including any secrets) and will change network routing for the processes it wraps.
Install Mechanism
No install spec is included (instruction-only plus a small helper script), so nothing will be automatically downloaded or written at install time. This lowers installer risk. The provided shell script simply calls proxymock and writes a temporary log file.
Credentials
The skill does not declare required env vars or credentials, but the CLI docs mention config paths (~/.speedscale/config.yaml), --api-key, and cloud push/pull commands that would require credentials if used. The SKILL.md metadata also indicates the proxymock binary is required (contradicting the registry 'none' listing). No unrelated secret env vars are demanded, but using the tool can expose any sensitive traffic it proxies.
Persistence & Privilege
always:false and no install-time persistence. The included script writes logs to a temporary file and proxymock itself writes RRPair files under proxymock/ when used; these are normal for a traffic-capture tool and scoped to the user's workspace.
What to consider before installing
This skill legitimately captures and replays network and database traffic; that is its purpose and it will see full request/response bodies (headers, cookies, auth tokens, DB statements). Before using it: (1) ensure the proxymock binary you run is from a trusted release (the skill has no install step), (2) avoid recording production systems or credentials unless you are sure you want their traffic recorded, (3) be aware that setting proxy env vars or running the app under proxymock will route traffic through the tool and could expose secrets, (4) the SKILL.md declares the proxymock binary as required, but the registry metadata omitted that — treat that as a packaging oversight and confirm the binary is present, and (5) if you plan to use cloud push/pull or proxymock init --api-key, ensure you understand where that API key will be stored (~/.speedscale/config.yaml) and that it is provided only to a trusted service. If you want a lower-risk test, run proxymock against a local staging environment with non-sensitive data first.Like a lobster shell, security has layers — review code before you run it.
latestvk979525cjffdkd8y7p0j0sdq3h81chz2
License
MIT-0
Free to use, modify, and redistribute. No attribution required.