ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Sparkle VPN

v1.1.0

Control Sparkle VPN - start, stop, manage system proxy, query status and switch nodes using Mihomo core directly.

⭐ 0· 669·1 current·1 all-time
by@cwyhkyochen-a11y
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The name/description (control Sparkle VPN via Mihomo core) align with the included scripts and index.ts handlers. Scripts operate on ~/.config/sparkle, call the local Mihomo binary (/opt/sparkle/resources/sidecar/mihomo) and the local API at 127.0.0.1:9090 — all consistent with the declared purpose.
✓
Instruction Scope
Runtime instructions and scripts stay within the VPN management domain: starting/stopping mihomo, switching nodes via the local API, and enabling/disabling system proxy via gsettings and a proxy.env file. The scripts also call ipinfo.io to display public IP (an external endpoint used only for diagnostics). They do not read or transmit unrelated files or secrets.
✓
Install Mechanism
There is no external installer or remote download; files are included in the skill bundle and index.ts runs local shell scripts. No URLs or archive extraction are used, lowering install risk.
ℹ
Credentials
The skill declares no required env vars or credentials (appropriate). However scripts assume availability of tools (curl, python3, gsettings, pgrep/pkill) and a local Mihomo binary at /opt/sparkle/... and a profile at ~/.config/sparkle/profiles/19c48c94cbb.yaml; these are reasonable for the task but are not declared. The only external network call is to ipinfo.io for IP checks (diagnostic only).
ℹ
Persistence & Privilege
always:false (normal). The skill can start/stop processes and change system proxy settings (gsettings and writing ~/.config/sparkle/proxy.env) and will therefore affect system state and network behavior — this is expected for a VPN control tool but is a privileged action the user should consent to.
Assessment
This skill appears to do exactly what it says: control a local Sparkle/Mihomo VPN. Before installing, verify: 1) you have the Mihomo/Sparkle binaries and the referenced profile (~/.config/sparkle/profiles/19c48c94cbb.yaml) or adjust scripts accordingly; 2) you are comfortable with scripts that start/kill processes and change GNOME proxy settings and write ~/.config/sparkle/proxy.env; 3) required tools (curl, python3, gsettings, pgrep/pkill) are present — the skill does not declare these dependencies; 4) the diagnostic call to https://ipinfo.io/ip will reveal your public IP to that service (harmless for most users, but note if you want no external calls). If unsure, inspect/modify the scripts (they are plain shell) or run them in an isolated/test environment first.

Like a lobster shell, security has layers — review code before you run it.

latestvk973260j1d1bjwhy0jqjs1rwj1820ys6

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments