Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Spell

v2.0.0

Log anything fast and find it later with search and export. Use when running lookups, checking entries, converting formats, generating summaries.

0· 194·1 current·1 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for bytesagain1/spell.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Spell" (bytesagain1/spell) from ClawHub.
Skill page: https://clawhub.ai/bytesagain1/spell
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install spell

ClawHub CLI

Package manager switcher

npx clawhub@latest install spell
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description claim a local logging/search utility. The included script implements exactly that behavior (creates ~/.local/share/spell, logs inputs, provides search/export/status). No unrelated credentials, services, or binaries are required.
Instruction Scope
SKILL.md describes running a 'spell' CLI and documents commands that match the script's behavior. Minor mismatch: the repository includes scripts/script.sh but no install instructions to make a 'spell' command available in PATH. The runtime instructions do not attempt to read unrelated system files or env vars beyond HOME/DATA_DIR. The tool will log whatever the user provides — so users should avoid entering secrets (logs are stored in plaintext).
Install Mechanism
There is no install spec (instruction-only), which is lower risk. The package contains a shell script (no remote downloads or extracted archives). Nothing in the manifest attempts to fetch or execute remote code.
Credentials
The skill declares no required environment variables or credentials and indeed uses only HOME (to build a local data dir). No keys, tokens, or unrelated env-vars are requested.
Persistence & Privilege
always is false and the skill does not request persistent platform-wide privileges. It writes files only under the user's home (~/.local/share/spell) and does not modify other skills or system-wide agent settings.
Assessment
This skill appears to do what it says: a simple offline logger/search/export tool that keeps data locally at ~/.local/share/spell. Before installing or using it: 1) review and, if needed, audit scripts/script.sh locally (it will append whatever you type to plaintext log files); 2) be careful not to enter passwords, API keys, or other secrets into entries (they will be stored unencrypted); 3) note there are no install steps provided — you may need to make scripts/script.sh executable and place it on your PATH (or adapt the SKILL.md commands); 4) optional: restrict permissions on the data dir (chmod 700 ~/.local/share/spell) if you want to limit access. Minor technical notes: the export JSON newline handling and search behavior could be improved (e.g., grep option handling for terms starting with '-') but these are implementation issues rather than security red flags.

Like a lobster shell, security has layers — review code before you run it.

latestvk973429d0jzvc5kmm2b4fngmhd833hnx
194downloads
0stars
1versions
Updated 1h ago
v2.0.0
MIT-0

Spell

Spell — a fast utility tools tool. Log anything, find it later, export when needed.

Why Spell?

  • Works entirely offline — your data never leaves your machine
  • Simple command-line interface, no GUI needed
  • Export to JSON, CSV, or plain text anytime
  • Automatic history and activity logging

Getting Started

# See what you can do
spell help

# Check current status
spell status

# View your statistics
spell stats

Commands

CommandWhat it does
spell runRun
spell checkCheck
spell convertConvert
spell analyzeAnalyze
spell generateGenerate
spell previewPreview
spell batchBatch
spell compareCompare
spell exportExport
spell configConfig
spell statusStatus
spell reportReport
spell statsSummary statistics
spell export<fmt> Export (json
spell search<term> Search entries
spell recentRecent activity
spell statusHealth check
spell helpShow this help
spell versionShow version
spell $name:$c entries
spell Total:$total entries
spell Datasize: $(du -sh "$DATA_DIR" 2>/dev/null
spell Version:v2.0.0
spell Datadir: $DATA_DIR
spell Entries:$(cat "$DATA_DIR"/*.log 2>/dev/null
spell Disk:$(du -sh "$DATA_DIR" 2>/dev/null
spell Last:$(tail -1 "$DATA_DIR/history.log" 2>/dev/null
spell Status:OK
spell [Spell]run: $input
spell Saved.Total run entries: $total
spell [Spell]check: $input
spell Saved.Total check entries: $total
spell [Spell]convert: $input
spell Saved.Total convert entries: $total
spell [Spell]analyze: $input
spell Saved.Total analyze entries: $total
spell [Spell]generate: $input
spell Saved.Total generate entries: $total
spell [Spell]preview: $input
spell Saved.Total preview entries: $total
spell [Spell]batch: $input
spell Saved.Total batch entries: $total
spell [Spell]compare: $input
spell Saved.Total compare entries: $total
spell [Spell]export: $input
spell Saved.Total export entries: $total
spell [Spell]config: $input
spell Saved.Total config entries: $total
spell [Spell]status: $input
spell Saved.Total status entries: $total
spell [Spell]report: $input
spell Saved.Total report entries: $total

Data Storage

All data is stored locally at ~/.local/share/spell/. Each action is logged with timestamps. Use export to back up your data anytime.

Feedback

Found a bug or have a suggestion? Let us know: https://bytesagain.com/feedback/


Powered by BytesAgain | bytesagain.com | hello@bytesagain.com

Comments

Loading comments...