Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Reg Limited

v1.0.2

Vehicle restriction query and reminder tool for Chinese cities. Query daily restrictions and set scheduled reminders.

0· 490·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for chandler0714/reg-limited.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Reg Limited" (chandler0714/reg-limited) from ClawHub.
Skill page: https://clawhub.ai/chandler0714/reg-limited
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install reg-limited

ClawHub CLI

Package manager switcher

npx clawhub@latest install reg-limited
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The README claims scheduled notifications via channels (Feishu/Telegram) and multi-city live queries, but the bundled code only (a) fetches Beijing data (attempting curl + HTML parsing) and (b) persists reminders to ~/.reg-limited/config.json. There is no implementation of notification delivery or scheduler, and other cities use static local rules. The SKILL.md also mentions network access and dependencies while the manifest lists no required binaries; however the code calls curl (child_process.execSync) which implies a required binary that is not declared.
!
Instruction Scope
SKILL.md instructs the agent to 'send notifications via scheduled tasks' and references message channels, but the code never sends notifications or integrates with external messaging APIs — it only writes reminders to a local config file. The code also reads process.env.HOME (not declared) and uses a curl command to fetch remote HTML. SKILL.md's stated parsing behavior and date ranges also conflict with comments and constants inside the code (different date ranges for Beijing), suggesting stale or inconsistent documentation.
Install Mechanism
There is no external install script or download; the package is instruction/code-only (bin/reg-limited.js and package.json). No network installs or archive downloads are used. This is lower risk, but the code invokes an external binary (curl) via child_process.execSync, so the runtime environment must provide curl for online fetching to work.
Credentials
The skill declares no required env vars or credentials (reasonable). The code reads process.env.HOME to create ~/.reg-limited/config.json and uses no API keys. Storing plate numbers and reminder data under the user's home folder is expected for a reminder tool but is not documented in SKILL.md or manifest — users should be aware local data is written to disk and contains vehicle plate numbers.
Persistence & Privilege
The skill does create and write a per-user config file (~/.reg-limited/config.json) but does not request global/system-wide persistence or 'always' privilege. It does not modify other skills' configs or system settings. Autonomous invocation is allowed (platform default) but not combined with elevated privileges.
What to consider before installing
This package appears to implement core query/check and reminder persistence but not the notification delivery SKILL.md promises, and it uses curl via child_process.execSync even though no required binaries are declared. Before installing or using it: (1) Inspect the code yourself or run it in a sandbox to confirm behavior; (2) ensure curl is available if you expect live Beijing fetching to work; (3) be aware it will create and write reminders (including plate numbers) to ~/.reg-limited/config.json; (4) do not provide sensitive credentials (none are required), and verify any planned notification integrations (Feishu/Telegram) are actually implemented before relying on them. These inconsistencies are likely due to incomplete/old documentation rather than explicit malice, but proceed with caution.
bin/reg-limited.js:42
Shell command execution detected (child_process).
bin/reg-limited.js:240
Environment variable access combined with network send.
!
bin/reg-limited.js:245
File read combined with network send (possible exfiltration).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

latestvk97a9ewpf9r2xj0bay73mfv1n585bndf
490downloads
0stars
3versions
Updated 17h ago
v1.0.2
MIT-0

RegLimited - Vehicle Restriction Query & Reminder

A tool to help you query vehicle restrictions and set reminders for Chinese cities.

Features

  1. Restriction Query - Check if your vehicle is restricted today based on city and plate
  2. Scheduled Reminders - Get notified at specified times about restriction info
  3. Multi-city Support - Supports major Chinese cities including Beijing, Shanghai, Guangzhou, Shenzhen, Hangzhou, Chengdu, etc.

Usage

1. Query Today's Restrictions

# Query today's restricted digits for a city
reg-limited query --city beijing

# Check if a plate is restricted
reg-limited check --city beijing --plate 京A12345

2. Set Restriction Reminders

# Basic usage
reg-limited add --city beijing --plate 京A12345 --time "07:00"

# Full parameters
reg-limited add --city beijing --plate 京A12345 --time "07:00" --notify-channel feishu

3. List All Reminders

reg-limited list

4. Remove Reminders

reg-limited remove --id <reminder_id>

Supported Cities

  • Beijing (北京)
  • Shanghai (上海)
  • Guangzhou (广州)
  • Shenzhen (深圳)
  • Hangzhou (杭州)
  • Chengdu (成都)
  • Tianjin (天津)
  • Wuhan (武汉)
  • Xi'an (西安)
  • Nanjing (南京)

Restriction Rules

Beijing

Queries real-time restriction data from Beijing Traffic Management Bureau:

DayRestricted
Monday3, 8
Tuesday4, 9
Wednesday5, 0
Thursday1, 6
Friday2, 7

Other Cities

  • Shanghai: Elevated road restrictions
  • Guangzhou: "Open Four, Stop Four" policy
  • Shenzhen: Morning/evening peak hour restrictions
  • Hangzhou/Chengdu/Tianjin/Wuhan/Xi'an/Nanjing: Day-specific number restrictions

Output Format

JSON format for program processing:

{
  "success": true,
  "data": {
    "city": "北京",
    "date": "2026-03-03",
    "restricted": ["4", "9"],
    "isRestricted": true,
    "plate": "京A12345",
    "lastDigit": "4"
  }
}

Example Dialogues

User: What's today's vehicle restriction in Beijing?
Bot: Today's restriction digits: 4, 9 (Your plate 4 is restricted!)

User: Is my car 京A12345 restricted today?
Bot: Yes! Today (Tuesday) Beijing restricts digits 4 and 9. Your plate ends with 4, so it's restricted.

User: Set a reminder for 7am tomorrow about restrictions
Bot: Done! You'll receive a restriction reminder at 7am tomorrow.

Technical Implementation

  1. Fetches daily restriction info from official government sources
  2. For Beijing: queries https://jtgl.beijing.gov.cn/jgj/lszt/659722/660341/index.html
  3. Parses restricted digits from the official table
  4. Compares with plate last digit
  5. Sends notifications via scheduled tasks

Dependencies

  • Node.js
  • Network access (for querying restrictions)
  • Message channels (Feishu/Telegram/etc.)

More cities coming soon...

Comments

Loading comments...