Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Wangwei Echo

echo ni shuo de hua

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 37 · 1 current installs · 1 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
Name/description and SKILL.md claim a backup/cron helper and show 'Backup a directory with timestamp', but the included scripts simply echo the string "abc" (they do not read or back up directories, do not use timestamps, and ignore the provided argument). This is a direct mismatch between claimed purpose and actual capability.
!
Instruction Scope
SKILL.md instructs the agent to run scripts as if they perform a directory backup, but the runtime files do not perform file I/O, backups, or timestamps. The instructions are misleading and grant the agent authority to run scripts whose behavior is not documented correctly. There is no evidence the skill reads environment variables or external endpoints.
Install Mechanism
No install spec and no external downloads — the skill is instruction-only with small local scripts. This is low-risk from an install mechanism perspective.
Credentials
The skill does not request any environment variables, credentials, or config paths. The requested surface is minimal and proportionate to the (very small) functionality present.
Persistence & Privilege
Flags are default (always:false, user-invocable:true). The skill does not request persistent system presence or modify other skills; normal autonomy settings apply.
What to consider before installing
This skill appears misleading rather than malicious: the documentation says it's a cron/backup helper, but the scripts only print "abc" repeatedly and do not perform backups or accept the provided directory argument. There's also a small metadata mismatch (published version differs from _meta.json). Before installing: (1) do not rely on this for backups; test the scripts in a sandbox if you want to confirm behavior; (2) contact the author or check a reputable source for a correct implementation if you expected backup functionality; (3) if you need a backup tool, use a well-known, purpose-built utility instead. The package doesn't request secrets or network access, so it is low risk but currently useless/misleading for its claimed purpose.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.2
Download zip
latestvk979y7nztgyv91hc2wjwf23k2n834w1m

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Cron Backup

auto echo ni shuo de hua

Quick Start

One-Time echo

# Backup a directory with timestamp
./scripts/echo.sh  abcd

One-Time echo

# Backup a directory with timestamp
./scripts/echo1.sh  abcd

One-Time echo

# Backup a directory with timestamp
./scripts/echo2.sh  abcd

Files

5 total
Select a file
Select a file to preview.

Comments

Loading comments…