Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Skill Version Manager
v1.0.0Skill 版本治理工具(semver 版本号规范 + 五步标准维护流程 + 回滚策略)
⭐ 0· 43·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's name and description (semver-based version governance) align with the content of SKILL.md. However, the runtime instructions call out commands and actions (git operations, clawhub package/publish) that imply the agent will need CLI tooling and network access, yet the registry metadata declares no required binaries and no network permission — this is an inconsistency that should be resolved.
Instruction Scope
SKILL.md instructs the agent to read and write skill files (changelog, SKILL.md, references/maintenance-log.md), run git commands (git checkout tags, git log), and run clawhub publish/packaging commands. Those are reasonable for a version manager, but they perform repository-modifying and publish actions that can alter multiple files and push packages. The file permission scope in metadata lists only skills/ (which fits), but network: [] conflicts with publish operations, and the document gives broad templates for edits without explicit guardrails (e.g., exact checks before pushing).
Install Mechanism
No install spec and no code files (instruction-only) — low install risk. Nothing will be downloaded or written by an installer step, but runtime operations described in SKILL.md assume existing tools.
Credentials
The skill requests no environment variables or credentials, which minimizes secret exposure. However, publishing via clawhub and performing git operations normally requires authentication (CLI tokens, git creds) that are not declared — expect the agent or environment to already hold those credentials. The absence of declared credential requirements is worth clarifying.
Persistence & Privilege
always is false and model invocation is allowed (default). The skill does not request persistent/system-wide privileges beyond reading/writing skills/ per its metadata. Still, its ability to edit skill files and run git/publish means it can make persistent changes to repository state when invoked.
What to consider before installing
This skill is conceptually coherent for managing semver and changelogs, but there are important mismatches and operational risks to address before installing:
- Clarify required tools and permissions: SKILL.md uses git and clawhub (network publishing). The registry metadata currently declares no required binaries and no network permission — confirm that git and clawhub are available in the runtime and that network/publish permissions are intended.
- Credential handling: Publishing normally needs authenticated credentials (git credentials, clawhub token). The skill lists no env vars; ensure any tokens used are scoped and stored securely, and that you know which account will be used to publish.
- Review scope of file access: The skill can modify SKILL.md and other files under skills/. Make sure the agent's file permissions are limited to the intended repository/path and that backups or CI gates exist before pushing.
- Audit publish workflow: The SKILL.md describes automated packaging and publish steps. Require manual review/explicit approval or enforce CISO gating in your process if you cannot fully trust autonomous publishes.
- Minimal recommended changes before use: update metadata to list required binaries (git, clawhub), set network permission if publishing is needed, and document the exact authentication mechanism and the network endpoints used by clawhub.
If these clarifications are provided and safeguards (credential scoping, manual approval gates) are in place, the skill can be used; until then treat it with caution.Like a lobster shell, security has layers — review code before you run it.
ct0vk97eg7ng3s7m2299h2vsr9kzeh84r3mzlatestvk97eg7ng3s7m2299h2vsr9kzeh84r3mzskill-maintenancevk97eg7ng3s7m2299h2vsr9kzeh84r3mzversioningvk97eg7ng3s7m2299h2vsr9kzeh84r3mz
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
