Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Skill Master

v1.0.4

Meta-skill for skill selection and routing. Use this skill FIRST when you are unsure which skill to use for a task. Provides a decision tree, keyword trigger...

0· 120·1 current·1 all-time
byNetanel Abergel@netanel-abergel

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for netanel-abergel/skill-master.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Skill Master" (netanel-abergel/skill-master) from ClawHub.
Skill page: https://clawhub.ai/netanel-abergel/skill-master
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install skill-master

ClawHub CLI

Package manager switcher

npx clawhub@latest install skill-master
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name and description (meta-skill for selecting/routing skills) match the SKILL.md behavior: lookup table, decision tree, and delegation. Requiring a logging/analytics capability (skill-analytics) is plausible for a router. However, the SKILL.md mandates writing to a specific host filesystem path (/opt/ocana/...) without declaring that config path or explaining access/retention policies.
!
Instruction Scope
The runtime instructions force the agent to append a JSON line to /opt/ocana/openclaw/workspace/data/skill-analytics.jsonl for every invocation and to 'Load that skill's SKILL.md and follow it.' This (1) requires persistent writes to a host path, (2) logs trigger/context strings that can contain sensitive user data with no sanitization or consent mechanism, and (3) instructs the agent to read other skills' SKILL.md files (broad file access). The spec does not justify why the path is hardcoded or how logs are shared/secured.
Install Mechanism
No install spec and no code files are present, so there is no external download or executable install risk. The main risk is runtime behavior described in SKILL.md (file writes and reads), not installation.
Credentials
The skill requests no environment variables or credentials, which is proportionate. However, it requires write access to a host path and implicitly relies on the separate skill-analytics skill (not shown) to share data across the PA network; those implicit privileges are not declared and may be disproportionate given the lack of consent/sanitization rules.
!
Persistence & Privilege
always is false (good), but the skill mandates persistent logging on every invocation to a global-looking path under /opt/ocana. Persistent, mandatory logs of triggers/context may capture private or sensitive content and are created without configuration options, retention policy, or encryption guidance. The skill's requirement that logging is 'NOT optional' increases its privilege surface.
What to consider before installing
This skill is plausible for routing, but it forces every invocation to be recorded to a hardcoded filesystem path and to load other skills' SKILL.md files. Before installing, verify: (1) who controls /opt/ocana/openclaw/workspace/data on your host and whether writing there is acceptable; (2) whether the logged fields (trigger, context) may contain sensitive info and whether logs are encrypted/retained/rotated; (3) what the separate skill-analytics skill does with these logs and whether it shares data off-host; (4) whether you can make logging optional, sanitize entries, or change the storage location; and (5) that reading other skills' SKILL.md files is acceptable in your environment. If you cannot confirm those, treat this as risky and consider requesting a version that uses configurable, consented logging or an opt-in analytics pathway.

Like a lobster shell, security has layers — review code before you run it.

latestvk979ccw2jxm3m058yyh1m0c1cs842g2a
120downloads
0stars
4versions
Updated 3w ago
v1.0.4
MIT-0

Skill Master

Minimum Model

Any model. This is a lookup table — any model can use it.


⚠️ Skill Count Rule

Current: 19 active skills. Sweet spot: 15–25. Above 30 = routing breaks down. Start lean. Add a new skill only when there's a clear, recurring trigger that no existing skill covers.


How to Use This Skill

  1. Read the owner's request.
  2. Find a match in the Quick Lookup table below.
  3. If not found, use the Decision Tree.
  4. ⚠️ Log the selection FIRST — before doing any work (see Analytics below).
  5. Load that skill's SKILL.md and follow it.

Do not improvise. If no skill matches, say so and ask the owner.

Skipping the log is not allowed. Every skill invocation must be recorded, even for simple tasks. This is how the agent and the owner track what's working.


📊 Analytics — MANDATORY: Log Every Skill Use

This step is NOT optional. Before starting any skill, append one line:

mkdir -p /opt/ocana/openclaw/workspace/data
echo "{\"ts\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\",\"skill\":\"SKILL_NAME\",\"trigger\":\"TRIGGER\",\"context\":\"CONTEXT\"}" \
  >> /opt/ocana/openclaw/workspace/data/skill-analytics.jsonl

Replace:

  • SKILL_NAME → the skill selected (e.g. meetings)
  • TRIGGER → the phrase that matched (e.g. schedule meeting with Daniel)
  • CONTEXTdm, group:<name>, or cron

This is ~50 bytes/entry. Non-negotiable.

Why This Matters

  • The owner can ask "skill stats" at any time to see what's being used
  • Unused skills get pruned, improving routing quality
  • Shared across the PA network so every agent learns from usage patterns
  • Enables weekly reports on which skills are carrying the most weight

To View Analytics

Ask: "skill stats" / "skill usage" / "which skills am I using?" → triggers skill-analytics skill



Quick Lookup — By Trigger Phrase

If the owner says...Use skill
"schedule a meeting with X"meetings
"summarize meeting notes" / "action items from meeting"meetings
"what's on my calendar today"owner-briefing
"send me a morning briefing"owner-briefing
"billing error" / "API out of credits"billing-monitor
"connect my calendar" / "can't write to calendar"calendar-setup
"connect Gmail" / "set up email"calendar-setup
"set up a new PA" / "onboard a new agent"pa-onboarding
"contact [person]'s PA" / "find PA phone number"ai-pa
"set up monday.com" / "create a board item" / "monday question"monday-for-agents
"I made a mistake" / "owner corrected me"self-learning
"backup workspace" / "push to git"maintenance
"update openclaw" / "update skills" / "run maintenance"maintenance
"what was discussed in [group]"whatsapp
"find new skill ideas" / "what skills are trending"skill-scout
"skill usage" / "skill stats" / "skill report"skill-analytics
"which skills am I using" / "unused skills"skill-analytics
"security check" / "check for vulnerabilities"self-monitor
"health check" / "check infrastructure"self-monitor
"how are all the PAs doing" / "PA network status"supervisor
"מה הסטטוס" / "what's the status"supervisor
"how am I doing" / "review my performance"eval
"run eval" / "מה עובד ומה לא"eval
"summarize this YouTube video"youtube-watcher
"add nikud to this" / "Hebrew vowel points"hebrew-nikud
"compact memory" / "organize memory"memory-tiering

Decision Tree

What kind of task is this?
│
├─ COMMUNICATION / COORDINATION
│   ├─ Find a PA's contact → ai-pa
│   ├─ Schedule a meeting → meetings
│   ├─ Summarize meeting notes → meetings
│   └─ Broadcast to all PAs → ai-pa
│
├─ SETUP / ONBOARDING
│   ├─ New PA from scratch → pa-onboarding
│   ├─ Connect Google Calendar or Gmail → calendar-setup
│   └─ Connect monday.com → monday-for-agents
│
├─ MONITORING / HEALTH
│   ├─ Billing error detected → billing-monitor
│   ├─ Infrastructure / security check → self-monitor
│   └─ Check all PAs at once → supervisor
│
├─ DAILY OPERATIONS
│   ├─ Morning/evening briefing → owner-briefing
│   ├─ monday.com board task → monday-for-agents
│   ├─ Backup workspace or update OpenClaw → maintenance
│   └─ WhatsApp conversation context → whatsapp
│
└─ SELF-IMPROVEMENT
    ├─ Owner corrected me → self-learning
    ├─ Performance review / audit → eval
    ├─ Find new skill ideas → skill-scout
    └─ Memory compaction → memory-tiering

Full Skill Library

SkillCategoryWhen to Use
ai-paCoordinationFind PA contacts, group JIDs, coordination protocols
billing-monitorHealthDetect and respond to API billing failures
calendar-setupSetupCalendar connection with write access + Gmail/email setup
evalSelf-improvementFull performance audit — scores tasks, checks PA health, reviews memory
hebrew-nikudUtilityAdd nikud (vowel points) to Hebrew text, especially for TTS
maintenanceInfrastructureWorkspace git backup (every 6h) + OpenClaw updates (weekly)
meetingsOperationsSchedule meetings AND summarize meeting notes/transcripts
memory-tieringMemoryHOT/WARM/COLD memory compaction and archiving
monday-for-agentsOperationsAll monday.com operations: API, MCP, boards, items
owner-briefingOperationsDaily morning/evening summaries
pa-onboardingSetupFull new agent setup from zero
self-learningSelf-improvementLog corrections and apply lessons; maintain HOT.md
self-monitorHealthInfrastructure + security checks, disk/memory/service health
skill-masterRoutingPick the right skill (this file)
skill-scoutDiscoveryWeekly search for new skill ideas
supervisorOperationsNetwork-wide status dashboard — all PAs, tasks, system health
whatsappMemoryPer-conversation context, unanswered tracking, loop prevention
youtube-watcherUtilityFetch and summarize YouTube video transcripts
skill-analyticsAnalyticsTrack skill usage, generate daily reports, find unused skills

Multi-Skill Workflows

Some tasks need multiple skills in sequence:

New PA Setup

pa-onboarding → calendar-setup → monday-for-agents → ai-pa (add to directory)

PA Network Health Check

supervisor → billing-monitor (flagged PAs) → self-monitor (infrastructure issues)

After a Mistake

self-learning (log it) → eval (update score) → SOUL.md (add rule if pattern)

Schedule a Meeting

ai-pa (find the other PA's contact) → meetings (coordinate + book)

Weekly Maintenance

whatsapp (weekly digest) → owner-briefing (include highlights) → maintenance (push to git)

After Important Group Chat

whatsapp (log decisions) → maintenance (push to GitHub)

Where to Run (Complexity Guide)

Run inline (main session)

  • ai-pa, billing-monitor, owner-briefing, supervisor, self-learning, maintenance

Consider subagent for heavy operations

  • calendar-setup, meetings (scheduling flow), monday-for-agents (bulk ops)

Spawn subagent (recommended)

  • pa-onboarding (20+ steps), eval (full monthly analysis), batch operations, skill-scout

Model Guidance

SkillMinimum Model
ai-pa, billing-monitor, supervisor, maintenance, owner-briefingAny
calendar-setup, pa-onboarding, whatsapp, memory-tieringSmall–Medium
meetings, monday-for-agents, skill-scoutMedium
eval (trend analysis), self-learning (writing rules)Medium–Large

Adding New Skills

When a new skill is added:

  1. Add a row to the Full Skill Library table.
  2. Add trigger phrases to Quick Lookup.
  3. Update the Decision Tree if it fits a new category.
  4. Add to any relevant Multi-Skill Workflows.
  5. Check skill count — stay under 32 active skills.
  6. Add the skill name to the KNOWN_SKILLS list in skill-analytics/SKILL.md.

Supervisor (Status Dashboard)

TriggerAction
"מה הסטטוס" / "what's the status"supervisor
"supervisor"supervisor
"מה קורה" / "give me a summary"supervisor

The supervisor skill aggregates: active tasks, billing issues, group activity, pending follow-ups, and system health into one structured report.


Eval

TriggerAction
"תעשי eval" / "run eval"eval
"מה עובד ומה לא"eval
"בדקי הכל"eval

The eval skill scores performance, audits tasks, checks PA network health, verifies integrations, and reviews memory quality — all in one report.


Cost Tips

  • This skill itself: Very cheap — it's a lookup table, any model works.
  • Routing decision: If unsure, lean toward a smaller, cheaper skill first.
  • Don't over-spawn: Use subagents only when the task would actually block the main session.

Comments

Loading comments...