Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

tone-rewriter

v1.0.0

Rewrite text in any of 10 tones (professional, casual, friendly, formal, empathetic, persuasive, academic, simple, witty, urgent) while preserving meaning. x...

0· 519·0 current·0 all-time
byDaisuke Narita@daisuke134

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for daisuke134/tone-rewriter.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "tone-rewriter" (daisuke134/tone-rewriter) from ClawHub.
Skill page: https://clawhub.ai/daisuke134/tone-rewriter
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install tone-rewriter

ClawHub CLI

Package manager switcher

npx clawhub@latest install tone-rewriter
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill claims a simple text-rewrite capability but the SKILL.md instructs callers to install a third-party npm CLI (awal) and use an x402 pay endpoint hosted on a Railway domain. The need for a payment/auth flow is not explained in the top-level metadata; asking a user to install a CLI and authenticate is disproportionate to the simple 'tone rewrite' description unless this is explicitly a paid third‑party service.
!
Instruction Scope
The instructions direct the agent/user to run 'npm install -g awal@2.0.3' and 'awal auth login', then use 'npx awal@2.0.3 x402 pay' to call a remote endpoint. These steps involve installing software, performing login/auth, and initiating a payment — all outside the minimal scope of rewriting text. The SKILL.md does not document what credentials are created, what is stored locally, or what data is sent to the upstream endpoint.
Install Mechanism
There is no formal install spec in the registry, but the SKILL.md requires installing a public npm package (awal) or using npx. Using an npm package is a moderate risk: it is traceable but executes third-party code. The network endpoint used (anicca-proxy-production.up.railway.app) is a third-party Railway app rather than a well-known vendor domain, which raises trust questions about who runs the service.
!
Credentials
The registry declares no required environment variables or credentials, yet the instructions require 'awal auth login' and a payment via x402. That implies creation/use of local credentials or wallet access not declared in the skill metadata. This is disproportionate because the skill asks for authentication/payment without specifying what secrets/scopes will be used or stored.
Persistence & Privilege
The skill is not marked 'always' and does not request system-wide privileges, but the advised 'awal auth login' flow likely persists auth tokens/credentials on the host. The skill could thereby gain continued access to the payment service or stored credentials across agent runs; the SKILL.md does not explain token lifecycle or revocation.
What to consider before installing
Before installing or invoking this skill: 1) Verify the operator of the endpoint (anicca-proxy-production.up.railway.app) and the 'awal' package (who maintains it, open source repo, npm page). 2) Do not run 'awal auth login' or install the CLI in a sensitive environment until you understand what credentials/wallets it requires and where tokens are stored. 3) Confirm pricing and payment flow (what triggers the $0.01 USDC charge and whether approvals are required). 4) If you must test, use an isolated environment or throwaway account/wallet and inspect what files/tokens 'awal' writes. 5) Ask the skill author for source code, a privacy/data-handling statement, and justification for using an external payment proxy; if they cannot provide these, treat the skill as risky.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎭 Clawdis
OSmacOS · Linux
latestvk97467cxva4kp5svj63yerqnp581yjxe
519downloads
0stars
1versions
Updated 14h ago
v1.0.0
MIT-0
macOS, Linux

tone-rewriter — Tone Rewriting Service for AI Agents

Rewrite any text in 10 different tones while preserving the original meaning. Pay $0.01 USDC per request via x402.

Prerequisite

npm install -g awal@2.0.3
awal auth login

Usage

npx awal@2.0.3 x402 pay https://anicca-proxy-production.up.railway.app/api/x402/tone-rewriter \
  -X POST \
  -d '{"text":"Hey fix this ASAP","target_tone":"professional"}'

Input Schema

FieldTypeRequiredDescription
textstringText to rewrite (max 2000 chars)
target_tonestringOne of: professional, casual, friendly, formal, empathetic, persuasive, academic, simple, witty, urgent
languagestringen, ja, or auto (default: auto)
preserve_lengthbooleanKeep output within ±20% of input length (default: false)

Output Schema

{
  "rewrite_id": "rw_a1b2c3",
  "original_text": "Hey fix this ASAP",
  "rewritten_text": "Could you please address this issue at your earliest convenience?",
  "target_tone": "professional",
  "detected_original_tone": "urgent",
  "language": "en",
  "confidence": 0.95,
  "safe_t_flag": false
}

Available Tones

ToneDescription
professionalFormal business language, clear and authoritative
casualRelaxed, conversational, everyday language
friendlyWarm, approachable, positive energy
formalStructured, polished, official documents
empatheticUnderstanding, compassionate, emotionally aware
persuasiveCompelling, action-oriented, motivating
academicScholarly, precise, evidence-based vocabulary
simplePlain language, short sentences, easy to understand
wittyClever, humorous undertone, engaging
urgentTime-sensitive, direct, action-demanding

Pricing

  • $0.01 USDC per request (Base network, x402 protocol)
  • Endpoint: https://anicca-proxy-production.up.railway.app/api/x402/tone-rewriter

Pairs well with

  • emotion-detector: Detect emotion → choose appropriate tone → rewrite
  • buddhist-counsel: Get guidance → rewrite in empathetic tone for the user

Comments

Loading comments...