Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Qa Agent

v1.0.0

Un agente para realizar tareas de control de calidad (QA), incluyendo análisis de código, ejecución de pruebas y reporte de problemas.

0· 699·0 current·0 all-time
bySteven Martínez@steven-mr3

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for steven-mr3/qa-agent.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Qa Agent" (steven-mr3/qa-agent) from ClawHub.
Skill page: https://clawhub.ai/steven-mr3/qa-agent
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install qa-agent

ClawHub CLI

Package manager switcher

npx clawhub@latest install qa-agent
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description match the provided artifacts: linting and test-runner scripts (ruff, pytest, eslint, jest) and reporting are exactly what the skill implements. Having helpers for both Python and JavaScript is coherent for a QA agent.
Instruction Scope
Runtime instructions are concrete: they run shell scripts in scripts/ that invoke linters and test frameworks against a provided path (default: current directory). This necessarily lets the skill read and execute code in the target directory (including any secrets present). The instructions do not attempt to exfiltrate data or contact external endpoints, but they do grant the skill broad discretion to run tests on arbitrary paths which may expose sensitive repo contents if run at an inappropriate scope.
!
Install Mechanism
Although described as instruction-only (no install spec), the published bundle contains ~850 files including a complete Python virtualenv (venv/) with pip, pytest, ruff and many vendored packages. The scripts call venv/bin/ruff and venv/bin/pytest directly. Bundling and executing a shipped virtualenv is unusual for an instruction-only skill and increases risk because bundled interpreters/entrypoints may run arbitrary code. There is no provenance / source URL for these packages and no install script verifying integrity.
Credentials
The skill declares no required environment variables, no credentials, and no config paths. The runtime scripts do not reference external env vars beyond typical shell behavior. This is proportional to a QA tool. (Note: some internal library code references standard PYTEST_THEME-like env vars for display, but nothing requires secrets.)
Persistence & Privilege
Skill flags are default: always:false, user-invocable:true, autonomous invocation allowed. The skill does not request permanent presence or modify other skills. Autonomous invocation combined with the bundled venv increases blast radius somewhat, but autonomous invocation alone is normal.
What to consider before installing
This skill appears to be a real QA helper, but exercise caution because the package includes a full Python virtualenv (hundreds of files) that the skill will execute (venv/bin/pytest and venv/bin/ruff). Before installing or running it: 1) Inspect the bundled venv (especially any scripts in venv/bin) to ensure there are no unexpected entrypoints or network calls; 2) Prefer running the skill in an isolated environment (container, sandbox, or ephemeral VM) and avoid pointing it at sensitive system directories or repos containing secrets; 3) If you already have ruff/pytest/eslint/jest installed and trust them, consider removing or replacing use of the bundled venv and relying on system tools; 4) Note that running the scripts against the current directory will let the skill read and execute your repository code — only run it where you control the contents. If you want higher assurance, ask the author for provenance (origin of the venv) or for a version that uses verified package installation rather than shipping a full venv.
venv/lib/python3.13/site-packages/_pytest/_code/code.py:161
Dynamic code execution detected.
venv/lib/python3.13/site-packages/_pytest/mark/__init__.py:67
Dynamic code execution detected.
venv/lib/python3.13/site-packages/_pytest/mark/expression.py:295
Dynamic code execution detected.
venv/lib/python3.13/site-packages/_pytest/pytester.py:295
Dynamic code execution detected.
venv/lib/python3.13/site-packages/_pytest/skipping.py:92
Dynamic code execution detected.
venv/lib/python3.13/site-packages/pip/_vendor/packaging/licenses/__init__.py:100
Dynamic code execution detected.
venv/lib/python3.13/site-packages/pip/_vendor/pygments/formatters/__init__.py:91
Dynamic code execution detected.
venv/lib/python3.13/site-packages/pygments/formatters/__init__.py:91
Dynamic code execution detected.
venv/lib/python3.13/site-packages/pygments/lexers/_julia_builtins.py:150
Dynamic code execution detected.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🧪 Clawdis
latestvk972e5gaa00r57kb8crn86d1dd834yk4
699downloads
0stars
1versions
Updated 2h ago
v1.0.0
MIT-0

Skill: QA Agent (Agente de Control de Calidad)

Esta skill permite a Omen actuar como un agente de QA, ayudando a asegurar la calidad del código y las funcionalidades.

Capacidades:

  • Análisis Estático de Código (Linting): Identificar problemas de estilo, errores potenciales y malas prácticas en el código fuente.
  • Ejecución de Pruebas Unitarias/Integración: Lanzar y monitorear frameworks de testing para verificar funcionalidades.
  • Generación de Reportes: Crear resúmenes de los resultados del QA, incluyendo errores detectados y sugerencias.

Requisitos:

Para un funcionamiento óptimo, se necesitan herramientas o librerías de línea de comandos para:

  • Linters: ruff para Python (venv), eslint para JavaScript (sistema).
  • Frameworks de Testing: pytest para Python (venv), jest para JavaScript (sistema).

Consideraciones:

  • Se priorizarán soluciones locales y de código abierto que sean fáciles de integrar y ejecutar en un entorno Linux.
  • La skill será flexible para soportar diferentes lenguajes de programación y frameworks.

Herramientas Implementadas

Todos los scripts residen en scripts/ relativo a esta skill. Acepta una ruta objetivo opcional como primer argumento; si se omite, se usa el directorio actual (o todos los tests en el caso de Jest).


1. Ruff — Python Linter

Binario: venv/bin/ruff (incluido en el venv de la skill)

Script: scripts/run_ruff.sh

Invocación:

bash scripts/run_ruff.sh [path] [extra ruff args...]

Ejemplos:

# Lint del directorio actual
bash scripts/run_ruff.sh

# Lint de un archivo o carpeta específica
bash scripts/run_ruff.sh src/

# Con flags adicionales de ruff
bash scripts/run_ruff.sh src/ --fix

Salida: Lista de infracciones con archivo, línea, código de regla y descripción. Código de salida 0 si no hay errores.


2. pytest — Python Testing Framework

Binario: venv/bin/pytest (incluido en el venv de la skill)

Script: scripts/run_pytest.sh

Invocación:

bash scripts/run_pytest.sh [path] [extra pytest args...]

Ejemplos:

# Ejecutar todos los tests del directorio actual
bash scripts/run_pytest.sh

# Ejecutar tests de una carpeta o archivo específico
bash scripts/run_pytest.sh tests/

# Con flags adicionales
bash scripts/run_pytest.sh tests/ -k "test_login" --tb=short

Salida: Reporte de tests con PASSED/FAILED/ERROR por test. Código de salida 0 si todos pasan.


3. ESLint — JavaScript Linter

Binario: eslint (instalado en el sistema, /usr/bin/eslint)

Script: scripts/run_eslint.sh

Invocación:

bash scripts/run_eslint.sh [path] [extra eslint args...]

Ejemplos:

# Lint del directorio actual
bash scripts/run_eslint.sh

# Lint de un archivo o carpeta específica
bash scripts/run_eslint.sh src/

# Con flags adicionales
bash scripts/run_eslint.sh src/ --fix --ext .js,.ts

Salida: Lista de advertencias/errores con archivo, línea, regla y descripción. Código de salida 0 si no hay errores.


4. Jest — JavaScript Testing Framework

Binario: jest (instalado en el sistema, /usr/bin/jest)

Script: scripts/run_jest.sh

Invocación:

bash scripts/run_jest.sh [path/pattern] [extra jest args...]

Ejemplos:

# Ejecutar todos los tests
bash scripts/run_jest.sh

# Ejecutar tests que coincidan con un patrón de ruta
bash scripts/run_jest.sh src/components/

# Con flags adicionales
bash scripts/run_jest.sh src/ --coverage --watchAll=false

Salida: Reporte de suites y tests con PASS/FAIL. Código de salida 0 si todos los tests pasan.

Comments

Loading comments...