Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

这是我的test3

v1.0.3

这是我的测试32323

0· 231·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for yequanzheng/trello3.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "这是我的test3" (yequanzheng/trello3) from ClawHub.
Skill page: https://clawhub.ai/yequanzheng/trello3
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install trello3

ClawHub CLI

Package manager switcher

npx clawhub@latest install trello3
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
SKILL.md clearly describes a GitHub/gh CLI skill (header 'GitHub Skill' and numerous gh examples), but registry metadata (slug 'trello3') and the published name/description are inconsistent and do not reflect GitHub. This mismatch could be a harmless packaging error or intentional mislabeling.
Instruction Scope
Instructions are narrowly scoped to running gh CLI commands and using --repo or GitHub API endpoints. They do not instruct reading arbitrary files, accessing unrelated environment variables, or transmitting data to unexpected endpoints.
Install Mechanism
No install spec and no code files — instruction-only skill. No files will be written to disk and nothing is downloaded or installed by the skill itself.
Credentials
The skill declares no required environment variables, no credentials, and the instructions do not reference secrets. This is proportionate for a gh CLI helper.
Persistence & Privilege
Defaults (always:false, agent may invoke autonomously). Autonomous invocation is permitted but not exceptional; combine this with the metadata mismatch if you are concerned about unintended actions.
What to consider before installing
Before installing: 1) Confirm whether you expected a GitHub skill — ask the publisher to fix the slug/name if it should be 'github' rather than 'trello3'. Metadata mismatches can be benign (packaging error) but also a sign of sloppy or malicious republishing. 2) Ensure you have the gh CLI installed and that you understand which repository (owner/repo) commands will target. 3) The skill requests no credentials, but verify any runtime prompts from your agent before it runs commands that could alter repositories. 4) If you don't want the agent to invoke the skill autonomously, disable autonomous invocation in your agent settings. 5) If unsure, run the skill in a restricted/test environment or ask the author for clarification and an updated manifest that matches the SKILL.md.

Like a lobster shell, security has layers — review code before you run it.

latestvk97ar4vrs7g0n7b1w8yyte1grn837330
231downloads
0stars
4versions
Updated 15h ago
v1.0.3
MIT-0

GitHub Skill

Use the gh CLI to interact with GitHub. Always specify --repo owner/repo when not in a git directory, or use URLs directly.

Pull Requests

Check CI status on a PR:

gh pr checks 55 --repo owner/repo

List recent workflow runs:

gh run list --repo owner/repo --limit 10

View a run and see which steps failed:

gh run view <run-id> --repo owner/repo

View logs for failed steps only:

gh run view <run-id> --repo owner/repo --log-failed

API for Advanced Queries

The gh api command is useful for accessing data not available through other subcommands.

Get PR with specific fields:

gh api repos/owner/repo/pulls/55 --jq '.title, .state, .user.login'

JSON Output

Most commands support --json for structured output. You can use --jq to filter:

gh issue list --repo owner/repo --json number,title --jq '.[] | "\(.number): \(.title)"'

Comments

Loading comments...