Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Delivery Queue

v1.2.0

Schedules and delivers segmented messages with timed delays and retries to simulate human-like communication and avoid spam detection.

0· 112·0 current·0 all-time
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The name/description promise scheduling and 'delivery' (including avoiding WhatsApp spam detection). The provided script only manages a local JSON queue (schedule, list, cancel, mark as sent, clean). There is no code to integrate with WhatsApp, Telegram, email servers, or any external delivery API, nor does the skill request any credentials. Claiming end-to-end delivery while shipping only a local queue is a clear capability mismatch.
!
Instruction Scope
SKILL.md describes a background worker that sends messages at scheduled times and emphasizes timing to avoid spam detection, but no background worker or sending logic exists in deliver.sh. The skill asks the agent to compose split messages but does not specify how/where those segments are transmitted. The mention of avoiding spam detection is an operational/ethical red flag and not justified by any implementation detail.
Install Mechanism
There is no install spec; the script is small and writes queue files under OPENCLAW_HOME or ~/.openclaw. No remote downloads or package installs are requested, which keeps install risk low.
Credentials
The skill declares no required env vars or credentials (only optionally uses OPENCLAW_HOME to locate the queue). This is inconsistent with the claimed ability to send messages through external services (which would normally require API keys/tokens). The absence of credential requirements means the script cannot actually perform external deliveries.
Persistence & Privilege
The skill does not request always:true and does not modify other skills or system settings. It persists data only in a per-user directory (~/.openclaw/delivery-queue by default). Autonomous invocation is allowed by platform default but is not combined with elevated privileges here.
What to consider before installing
This skill is inconsistent: it claims to deliver messages (including WhatsApp/Telegram) and to evade spam detection, but the included code only queues JSON files and marks them as sent—there is no network/sending logic or credentials. Before installing, consider: - Do you expect this skill to actually send messages? If so, it currently cannot; you would need a separate worker that calls real messaging APIs and would require API keys/tokens. - Be cautious about the 'avoid spam detection' language—using timing to evade spam filters can violate platform policies and laws. - Inspect any additional code you plan to add (the worker/sender) and only provide credentials to well-known APIs you trust. - Because the script writes to ~/.openclaw, run it in a sandbox first and do not point it at real contact lists until you confirm its behavior. If the author intends this only as a local queue manager, the README should be corrected to remove claims of actual delivery and anti-spam behavior and should document how to plug in a real sender and what credentials are required.

Like a lobster shell, security has layers — review code before you run it.

latestvk97101s9w3jrp8nvzjgm8vk1a183kqqq
112downloads
0stars
3versions
Updated 3w ago
v1.2.0
MIT-0

delivery-queue — Delayed Segmented Delivery

Schedule and deliver messages in timed segments to simulate human-like sending patterns.

Use Cases

  • Break long product introductions into 3-5 digestible messages
  • Schedule follow-ups at optimal times (e.g., prospect's local 9 AM)
  • Drip campaigns: space out nurture messages over days
  • Avoid WhatsApp spam detection by pacing outbound messages

Commands

  • deliver:schedule — Queue a message for future delivery
  • deliver:list — View pending deliveries
  • deliver:cancel — Cancel a scheduled delivery
  • deliver:flush — Send all pending messages immediately

Configuration

default_delay_ms: 3000        # Delay between segments
max_segments: 10              # Max segments per delivery
timezone: "{{timezone}}"      # Owner's timezone
quiet_hours:                  # Don't send during these hours
  start: "22:00"
  end: "07:00"

Usage Example

Schedule a 3-part product intro to +1234567890:
1. Company overview (send now)
2. Product highlights (send after 5 min)
3. Pricing inquiry (send after 15 min)

How It Works

  1. AI composes the full message sequence
  2. Skill splits into segments with timing
  3. Each segment is queued with a delivery timestamp
  4. Background worker sends at scheduled times
  5. Failed deliveries retry up to 3 times

File Structure

delivery-queue/
├── SKILL.md          # This file
└── deliver.sh        # Queue management script

Comments

Loading comments...