Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Zip

Zip - command-line tool for everyday use

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 41 · 0 current installs · 0 all-time installs
bybytesagain4@xueyetianya
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The name/description (compress, extract, encrypt, everyday zip tool) does not match the bundled script, which implements a sysops-style logging/notes toolkit (commands like scan, monitor, report, alert, top, backup, etc.). There is no compression/extraction/encryption code present. This is a clear mismatch between claimed purpose and actual capability.
!
Instruction Scope
SKILL.md documents commands such as 'zip run', 'zip export json', and references a configurable ZIP_DIR, but the script implements different commands (scan, monitor, report, export, stats, status, search, etc.) and always uses DATA_DIR='${HOME}/.local/share/zip' (it does not read ZIP_DIR). The SKILL.md and the script are inconsistent and could mislead users/agents about what will be run. The script writes and reads many log files under the user's home directory (history.log, *.log), which may capture any input sent to the tool — a privacy concern.
Install Mechanism
No install spec is provided (instruction-only skill with a bundled script). No external downloads or package installs are performed. That lowers supply-chain risk, though the packaged script will run if invoked.
Credentials
The skill declares no required environment variables or credentials, which matches the script (it uses HOME only). However SKILL.md suggests setting ZIP_DIR while the script ignores it — a documentation/code mismatch. The script stores data under ~/.local/share/zip, so it will create and modify files there (expected but worth noting).
Persistence & Privilege
The skill is not forced always-on and requests no extra platform privileges. Its persistence is limited to creating and writing files under the user's home directory (~/.local/share/zip). It does not modify other skills or system-wide settings.
What to consider before installing
The skill's description promises a ZIP/compression utility, but the included script is actually a local logging/sysops tool — they do not match. Before installing or invoking: (1) don't assume it provides compression/encryption; test it in a sandbox or throwaway account; (2) be aware it will create and write files under ~/.local/share/zip and can record any input you send to it (privacy risk); (3) if you expected a compression tool, do not install — ask the publisher for clarification or request the real tool/source; (4) if you still want to try it, review the full script locally and run with limited inputs, or run it in an isolated environment. The mismatch in documentation vs code is a red flag — proceed cautiously.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.2
Download zip
latestvk97c1d7kqcp6e4p6n0am9jk6f18317nb

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Zip

Zip toolkit — compress, extract, list contents, encrypt, and batch operations.

Commands

CommandDescription
zip helpShow usage info
zip runRun main task
zip statusCheck state
zip listList items
zip add <item>Add item
zip export <fmt>Export data

Usage

zip help
zip run
zip status

Examples

zip help
zip run
zip export json

Output

Results go to stdout. Save with zip run > output.txt.

Configuration

Set ZIP_DIR to change data directory. Default: ~/.local/share/zip/


Powered by BytesAgain | bytesagain.com Feedback & Feature Requests: https://bytesagain.com/feedback

Features

  • Simple command-line interface for quick access
  • Local data storage with JSON/CSV export
  • History tracking and activity logs
  • Search across all entries
  • Status monitoring and health checks
  • No external dependencies required

Quick Start

# Check status
zip status

# View help and available commands
zip help

# View statistics
zip stats

# Export your data
zip export json

How It Works

Zip stores all data locally in ~/.local/share/zip/. Each command logs activity with timestamps for full traceability. Use stats to see a summary, or export to back up your data in JSON, CSV, or plain text format.

Support

Powered by BytesAgain | bytesagain.com

Files

2 total
Select a file
Select a file to preview.

Comments

Loading comments…