ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

stratos-storage

v1.0.0

Upload and download files to/from Stratos Decentralized Storage (SDS) network. Use when the user wants to store files on Stratos, retrieve files from Stratos, upload to decentralized storage, or download from SDS.

⭐ 0· 692·0 current·0 all-time
by@notboxqsn
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description, required binaries (curl), and env vars (STRATOS_SPFS_GATEWAY, STRATOS_NODE_DIR) match the actual behavior: the scripts call an SPFS gateway and optionally the local ppd CLI. The primary credential (gateway URL) is appropriate for this purpose.
ℹ
Instruction Scope
Runtime instructions are limited to running the provided upload/download scripts which use the SPFS HTTP API (via curl) and fall back to the local ppd CLI. This stays within the stated purpose. Minor issues: SKILL.md sometimes references $SKILL_DIR (not declared) which may confuse automatic invocation; the ppd fallback will interact with the user's node directory and thus may access wallet-related node state (expected for node-based uploads/downloads).
ℹ
Install Mechanism
No third-party downloads or suspicious installers are present. skill.json suggests installing curl via brew/apt-get if missing — this is standard but requires package-manager privileges. No remote archives or unusual URLs are used.
✓
Credentials
Only two required env vars are declared and used: STRATOS_SPFS_GATEWAY and STRATOS_NODE_DIR. skill.json also lists STRATOS_RPC_PORT as an env default (not used by the scripts) — a minor discrepancy. Be aware that using the ppd CLI fallback implies access to the node directory which can contain wallet keys and sensitive node data; that access is proportional to the skill's purpose but worth user awareness.
✓
Persistence & Privilege
always:false and standard autonomous invocation are set. The skill does not request permanent system-wide privileges or modify other skills. No privileged persistence behavior observed.
Assessment
This skill appears to do what it claims: upload/download via a Stratos SPFS gateway or a local ppd node. Before installing or invoking it: (1) verify STRATOS_SPFS_GATEWAY points to a trusted gateway (avoid unknown remote endpoints), (2) confirm STRATOS_NODE_DIR points to the intended node (be aware the ppd fallback may access wallet/node files), (3) run the shell scripts manually in a controlled environment first to observe behavior, and (4) note skill.json mentions installing curl with apt/brew which requires package-manager privileges. If you plan to expose a remote gateway, ensure you trust that endpoint because file data and metadata will transit it.

Like a lobster shell, security has layers — review code before you run it.

latestvk973vv627dhb13d4pe9w68x8zn8130yn

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

Binscurl
EnvSTRATOS_SPFS_GATEWAY, STRATOS_NODE_DIR
Primary envSTRATOS_SPFS_GATEWAY

Comments